@herbertgao/pi-extensions 2026.8.3 → 2026.8.5

package/node_modules/pi-lens/dist/clients/git-tracked-ignore.js

@@ -178,6 +178,10 @@ export function collectTrackedFiles(cwd) {
     // this file's module doc for why this diverges from `collectUntrackedIgnoredIds`.
     const key = normalizeEphemeralMapKey(cwd);
     const now = Date.now();
+    for (const [snapshotKey, entry] of _trackedCache) {
+        if (now - entry.fetchedAtMs >= CACHE_TTL_MS)
+            _trackedSnapshot.delete(snapshotKey);
+    }
     const cached = _trackedCache.get(key);
     if (cached && now - cached.fetchedAtMs < CACHE_TTL_MS)
         return cached.promise;

package/node_modules/pi-lens/dist/clients/go-client.js

@@ -6,6 +6,7 @@
  * Requires: gopls (go install golang.org/x/tools/gopls@latest)
  * Docs: https://pkg.go.dev/golang.org/x/tools/gopls
  */
+import { createSubsystemLogger } from "./extension-log.js";
 import * as fs from "node:fs";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
@@ -27,7 +28,7 @@ export class GoClient {
     log;
     constructor(verbose = false) {
         this.log = verbose
-            ? (msg) => console.error(`[go] ${msg}`)
+            ? createSubsystemLogger("go")
             : () => { };
     }
     /**

package/node_modules/pi-lens/dist/clients/govulncheck-client.js

@@ -20,6 +20,7 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { assertInstallAllowed } from "./project-trust.js";
 import { SecurityScanClient } from "./security-scan-client.js";
 const EMPTY_RESULT = {
     success: false,
@@ -53,6 +54,13 @@ export class GovulncheckClient extends SecurityScanClient {
             this.available = true;
             return true;
         }
+        if (!assertInstallAllowed("govulncheck go install")) {
+            // Deliberately NOT latching `available = false` (#1350 delta review):
+            // trust denial is policy, not tool absence -- a later trust grant
+            // (re-adopted at turn_start) must be able to retry the install, and
+            // the cached false in ensureAvailable() would make denial permanent.
+            return false;
+        }
         // Not on PATH — auto-install via `go install`. This is safe to assume
         // here because the only path reaching `ensureAvailable()` is the
         // session_start task gated on `hasGoModule(analysisRoot)`; if the

package/node_modules/pi-lens/dist/clients/grammar-source.js

@@ -11,6 +11,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { writeFileAtomic } from "./atomic-write.js";
 /** tree-sitter-wasms release the grammars are pulled from. */
 export const TREE_SITTER_WASMS_VERSION = "0.1.13";
 /** unpkg mirror of the tree-sitter-wasms artifacts. */
@@ -110,11 +111,18 @@ export function grammarBlockReason(filename, rt = currentGrammarRuntime()) {
     return block?.blocked(rt) ? block.reason : null;
 }
 /**
- * Fetch one grammar wasm into `destDir` (atomic via a temp file). Returns true
+ * Fetch one grammar wasm into `destDir`, staged and renamed via
+ * `atomic-write.ts` so a reader never sees a half-written wasm. Returns true
  * on success. Never throws — a failed fetch (offline, 4xx) degrades to "grammar
  * unavailable" so callers can decide how to handle it. A grammar that crashes the
  * runtime is protected at LOAD time (BLOCKED_GRAMMARS / grammarBlockReason), not
  * by refusing to download it.
+ *
+ * #1217: the staging name used to be hand-rolled `.${filename}.${pid}.tmp` —
+ * per-process, so two concurrent fetches of one grammar shared a staging inode
+ * (#1205). `tree-sitter-client.ts` de-dupes in-flight fetches per grammar file,
+ * which made that hard to reach through the runtime path but did not cover
+ * direct callers.
  */
 export async function downloadGrammar(destDir, filename) {
     try {
@@ -123,9 +131,9 @@ export async function downloadGrammar(destDir, filename) {
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
         const data = Buffer.from(await res.arrayBuffer());
-        const tmp = path.join(destDir, `.${filename}.${process.pid}.tmp`);
-        fs.writeFileSync(tmp, data);
-        fs.renameSync(tmp, path.join(destDir, filename));
+        // bestEffort: false — a swallowed write failure would return true for a
+        // grammar that never landed.
+        writeFileAtomic(path.join(destDir, filename), data, { bestEffort: false });
         return true;
     }
     catch {

package/node_modules/pi-lens/dist/clients/gzip-stage-write.js

@@ -4,10 +4,12 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { parentPort } from "node:worker_threads";
 import { createGzip } from "node:zlib";
+import { stagePathFor } from "./atomic-write-staging.js";
 /**
  * Shared worker-thread body-persist core (#958, single source of truth #883):
- * `JSON.stringify` → chunked `createGzip` pipeline → `<stagePath>.tmp-<pid>` →
- * atomic rename to `stagePath`, returning byte/timing metrics. Both
+ * `JSON.stringify` → chunked `createGzip` pipeline → a per-call staging file
+ * from `atomic-write.ts`'s {@link stagePathFor} → atomic rename to
+ * `stagePath`, returning byte/timing metrics. Both
  * `clients/review-graph/persist-worker.ts` and
  * `clients/project-snapshot-persist-worker.ts` call this so the streamed-gzip
  * write lives in exactly one place; each worker's `parentPort` wiring owns its
@@ -19,9 +21,25 @@ import { createGzip } from "node:zlib";
  * On failure the partial `.tmp` is removed and the error is rethrown for the
  * caller to record; the `stagePath` itself is only ever created by the atomic
  * rename, so a crash mid-write can never leave a torn stage file behind.
+ *
+ * That crash-safety is NOT the same as concurrency isolation, and this
+ * docstring used to conflate the two (#1217). The staging name is what keeps
+ * two concurrent calls on one `stagePath` from writing into a shared inode,
+ * and it has to come from `stagePathFor` rather than a local
+ * `${stagePath}.tmp-${process.pid}`: this module runs on worker threads, which
+ * share `process.pid` with the main thread and with each other, so pid alone
+ * isolates nothing here (#1205's per-pid tear, verbatim). Callers normally
+ * pass a per-generation `stagePath`, which makes the overlap rare — a retry, a
+ * re-queued persist, a repeated generation, or a future non-generational
+ * caller makes it exact. Beyond tear-freedom this offers nothing: two calls on
+ * one `stagePath` are still unordered and last-rename-wins on POSIX — on
+ * Windows, MoveFileEx's REPLACE_EXISTING does not serialize concurrent replaces
+ * of the same destination, so one rename can fail with EPERM instead, which
+ * the caller must treat as a persist failure (both persist workers fall back
+ * to a main-thread rewrite on an error result).
  */
 export async function writeGzipStageFile(data, stagePath, testDelayMs) {
-    const tmpPath = `${stagePath}.tmp-${process.pid}`;
+    const tmpPath = stagePathFor(stagePath);
     try {
         if (testDelayMs) {
             await new Promise((resolve) => setTimeout(resolve, testDelayMs));

package/node_modules/pi-lens/dist/clients/host-ports.js

@@ -0,0 +1,31 @@
+/** Host-neutral capabilities available to the pi-lens engine (#1358 S2). */
+/**
+ * Headless/test implementation. Its feature-detection defaults deliberately
+ * match the pre-ports absent-host paths: unknown trust/mode, fail-open spawn,
+ * and no-op delivery surfaces.
+ */
+export function createDefaultHostPorts(overrides = {}) {
+    const unknownMode = () => "unknown";
+    const defaults = {
+        notify: { user: () => { } },
+        trust: { isProjectTrusted: () => "unknown" },
+        mode: {
+            current: unknownMode,
+            supportsTuiWidget: () => true,
+            suppressesUserNotify: () => false,
+        },
+        log: { extension: () => { }, debug: () => { }, sink: () => () => { } },
+        emit: { bus: () => { }, lens: () => { } },
+        status: { set: () => { } },
+        spawn: { abortSignal: () => undefined, isAllowed: () => true },
+        render: { invalidate: () => { } },
+        session: { id: () => undefined },
+        workspace: { cwd: () => undefined, projectRoot: () => undefined },
+        flags: { get: () => undefined },
+        tools: { has: async () => false, getActive: () => [], setActive: () => { } },
+    };
+    return Object.fromEntries(Object.entries(defaults).map(([group, value]) => [
+        group,
+        { ...value, ...(overrides[group] ?? {}) },
+    ]));
+}