@herbertgao/pi-extensions 2026.8.4 → 2026.8.6

package/node_modules/pi-lens/dist/clients/git-tracked-ignore.js

@@ -178,6 +178,10 @@ export function collectTrackedFiles(cwd) {
     // this file's module doc for why this diverges from `collectUntrackedIgnoredIds`.
     const key = normalizeEphemeralMapKey(cwd);
     const now = Date.now();
+    for (const [snapshotKey, entry] of _trackedCache) {
+        if (now - entry.fetchedAtMs >= CACHE_TTL_MS)
+            _trackedSnapshot.delete(snapshotKey);
+    }
     const cached = _trackedCache.get(key);
     if (cached && now - cached.fetchedAtMs < CACHE_TTL_MS)
         return cached.promise;

package/node_modules/pi-lens/dist/clients/go-client.js

@@ -6,15 +6,17 @@
  * Requires: gopls (go install golang.org/x/tools/gopls@latest)
  * Docs: https://pkg.go.dev/golang.org/x/tools/gopls
  */
-import * as fs from "node:fs";
+import { createSubsystemLogger } from "./extension-log.js";
 import * as path from "node:path";
-import { safeSpawnAsync } from "./safe-spawn.js";
+import { createToolchainAvailability, } from "./dispatch/runners/utils/toolchain-availability.js";
 // --- Common install paths ---
 const GO_WINDOWS_PATHS = [
     "C:\\Program Files\\Go\\bin\\go.exe",
     "C:\\Go\\bin\\go.exe",
     "go.exe", // PATH
 ];
+/** Budget for the PATH candidate's `go version` probe, ms. */
+const PROBE_TIMEOUT_MS = 3_000;
 const GO_UNIX_PATHS = [
     "/usr/local/go/bin/go",
     "/usr/bin/go",
@@ -22,58 +24,39 @@ const GO_UNIX_PATHS = [
 ];
 // --- Client ---
 export class GoClient {
-    goAvailable = null;
-    goPath = null;
+    /**
+     * Availability lifecycle, behind the shared transient-aware latch (#1476).
+     * The PATH candidate is resolved by spawning `go version` with a 3 s budget,
+     * so a host stall could latch "no Go toolchain" for the whole session and
+     * silently disable every Go diagnostic until restart.
+     */
+    availability;
     log;
     constructor(verbose = false) {
         this.log = verbose
-            ? (msg) => console.error(`[go] ${msg}`)
+            ? createSubsystemLogger("go")
             : () => { };
+        this.availability = createToolchainAvailability({
+            tool: "go",
+            label: "Go",
+            windowsPaths: GO_WINDOWS_PATHS,
+            unixPaths: GO_UNIX_PATHS,
+            probeArgs: ["version"],
+            budgetMs: PROBE_TIMEOUT_MS,
+            log: (msg) => this.log(msg),
+        });
     }
     /**
      * Find go executable path (async — probes PATH candidates off the event loop).
      */
     async findGoPathAsync() {
-        if (this.goPath)
-            return this.goPath;
-        const paths = process.platform === "win32" ? GO_WINDOWS_PATHS : GO_UNIX_PATHS;
-        for (const p of paths) {
-            try {
-                if (p.includes("\\") || p.includes("/")) {
-                    // Absolute path - check if exists
-                    if (fs.existsSync(p)) {
-                        this.goPath = p;
-                        return p;
-                    }
-                }
-                else {
-                    // Relative (PATH) - try running it
-                    const result = await safeSpawnAsync(p, ["version"], {
-                        timeout: 3000,
-                    });
-                    if (!result.error && result.status === 0) {
-                        this.goPath = p;
-                        return p;
-                    }
-                }
-            }
-            catch (err) {
-                void err;
-            }
-        }
-        return null;
+        return this.availability.findPath();
     }
     /**
      * Check if Go is installed (cached)
      */
     async isGoAvailableAsync() {
-        if (this.goAvailable !== null)
-            return this.goAvailable;
-        this.goAvailable = (await this.findGoPathAsync()) !== null;
-        if (this.goAvailable) {
-            this.log(`Go found: ${this.goPath}`);
-        }
-        return this.goAvailable;
+        return this.availability.isAvailable();
     }
     /**
      * Check if a file is a Go file

package/node_modules/pi-lens/dist/clients/govulncheck-client.js

@@ -20,12 +20,16 @@ import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { assertInstallAllowed } from "./project-trust.js";
 import { SecurityScanClient } from "./security-scan-client.js";
+import { classifyProbeFailure, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 const EMPTY_RESULT = {
     success: false,
     findings: [],
 };
 const SCAN_TIMEOUT_MS = 120_000;
+/** Budget for the `go install` auto-install, ms. */
+const INSTALL_TIMEOUT_MS = 60_000;
 // --- Client ---
 export class GovulncheckClient extends SecurityScanClient {
     constructor(verbose = false) {
@@ -53,33 +57,122 @@ export class GovulncheckClient extends SecurityScanClient {
             this.available = true;
             return true;
         }
+        if (this.probeWasTransient()) {
+            // #1467: a timed-out/killed probe says nothing about whether
+            // govulncheck is on PATH. Latching `false` here disabled it for the
+            // life of the process; a `go install` here would be a heavyweight
+            // reaction to a host hiccup. Record an expiring verdict, retry later.
+            this.log("govulncheck probe timed out; retrying later (not installing)");
+            this.markTransientlyUnavailable(this.lastProbeCause ?? "probe-timeout");
+            return false;
+        }
+        if (!assertInstallAllowed("govulncheck go install")) {
+            // Deliberately NOT latching `available = false` (#1350 delta review):
+            // trust denial is policy, not tool absence -- a later trust grant
+            // (re-adopted at turn_start) must be able to retry the install, and
+            // the cached false in ensureAvailable() would make denial permanent.
+            return false;
+        }
         // Not on PATH — auto-install via `go install`. This is safe to assume
         // here because the only path reaching `ensureAvailable()` is the
         // session_start task gated on `hasGoModule(analysisRoot)`; if the
         // project has a go.mod the user has the Go toolchain by definition.
         // Same shape as rust-clippy / cargo: lean on the language's own
         // install mechanism rather than adding a new installer strategy.
-        const goOnPath = await safeSpawnAsync("go", ["version"], {
-            timeout: 5000,
-        });
+        const goProbeStartedAt = Date.now();
+        const goSampler = startHostStallSampler();
+        let goOnPath;
+        let goHostStallMs;
+        try {
+            goOnPath = await safeSpawnAsync("go", ["version"], {
+                timeout: 5000,
+            });
+        }
+        finally {
+            goHostStallMs = goSampler.stop();
+        }
         if (goOnPath.error || goOnPath.status !== 0) {
+            const { outcome, cause } = classifyProbeFailure(goOnPath, {
+                hostStallMs: goHostStallMs,
+            });
+            if (outcome === "transient") {
+                this.log("`go version` probe timed out; retrying govulncheck later");
+                const retryAfterMs = this.markTransientlyUnavailable(cause);
+                logAvailabilityDecision({
+                    tool: "govulncheck",
+                    verdict: "unavailable",
+                    outcome,
+                    cause,
+                    elapsedMs: Date.now() - goProbeStartedAt,
+                    latched: false,
+                    hostStallMs: goHostStallMs,
+                    ...(retryAfterMs > 0 && { retryAfterMs }),
+                    budgetMs: 5000,
+                });
+                return false;
+            }
             this.log("go binary not on PATH — cannot auto-install govulncheck");
             this.available = false;
             return false;
         }
         this.log("govulncheck not found, attempting auto-install via go install");
-        const install = await safeSpawnAsync("go", ["install", "golang.org/x/vuln/cmd/govulncheck@latest"], { timeout: 60_000 });
+        const installStartedAt = Date.now();
+        const installSampler = startHostStallSampler();
+        let install;
+        let installHostStallMs;
+        try {
+            install = await safeSpawnAsync("go", ["install", "golang.org/x/vuln/cmd/govulncheck@latest"], { timeout: INSTALL_TIMEOUT_MS });
+        }
+        finally {
+            installHostStallMs = installSampler.stop();
+        }
         if (install.error || install.status !== 0) {
             this.log(`govulncheck auto-install failed: ${(install.stderr ?? "").slice(0, 200)}`);
+            // #1476: `go install` runs against a 60 s budget over the network. A
+            // timed-out or killed install says nothing about whether govulncheck
+            // can ever be installed here, so it must not latch the durable
+            // "tool is not installed" verdict the way a real install refusal does.
+            // A non-zero exit (module not found, compile error) still latches:
+            // that IS evidence about this machine, and retrying it every turn
+            // would be a `go install` storm.
+            const { outcome, cause } = classifyProbeFailure(install, {
+                hostStallMs: installHostStallMs,
+            });
+            if (outcome === "transient") {
+                const retryAfterMs = this.markTransientlyUnavailable(cause);
+                // One record per decision, so an install that keeps timing out is
+                // readable in latency.log the same day (#1467's forensic trail).
+                logAvailabilityDecision({
+                    tool: "govulncheck",
+                    verdict: "unavailable",
+                    outcome,
+                    cause,
+                    elapsedMs: Date.now() - installStartedAt,
+                    latched: false,
+                    hostStallMs: installHostStallMs,
+                    ...(retryAfterMs > 0 && { retryAfterMs }),
+                    budgetMs: INSTALL_TIMEOUT_MS,
+                });
+                return false;
+            }
             this.available = false;
             return false;
         }
         // `go install` writes to `$GOBIN` or `$GOPATH/bin`. The user may not
         // have that on `$PATH`. Re-probe by name (works when it is on PATH)
         // then fall back to the canonical bin dirs.
-        const reprobe = await safeSpawnAsync("govulncheck", ["-version"], {
-            timeout: 5000,
-        });
+        const reprobeStartedAt = Date.now();
+        const reprobeSampler = startHostStallSampler();
+        let reprobe;
+        let reprobeHostStallMs;
+        try {
+            reprobe = await safeSpawnAsync("govulncheck", ["-version"], {
+                timeout: 5000,
+            });
+        }
+        finally {
+            reprobeHostStallMs = reprobeSampler.stop();
+        }
         if (!reprobe.error && reprobe.status === 0) {
             this.log("govulncheck auto-installed and found on PATH");
             this.available = true;
@@ -110,6 +203,30 @@ export class GovulncheckClient extends SecurityScanClient {
                 // fall through to next candidate
             }
         }
+        // The install SUCCEEDED, so the tool is on this machine somewhere. If the
+        // re-probe merely timed out, latching "not installed" would be the #1467
+        // mistake one step later in the same function (#1476).
+        const { outcome, cause } = classifyProbeFailure(reprobe, {
+            hostStallMs: reprobeHostStallMs,
+        });
+        if (outcome === "transient") {
+            this.log("govulncheck installed but the re-probe timed out; retrying later");
+            const retryAfterMs = this.markTransientlyUnavailable(cause);
+            logAvailabilityDecision({
+                tool: "govulncheck",
+                verdict: "unavailable",
+                outcome,
+                cause,
+                // The re-probe's own wall time. A hard-coded 0 here was the #1474
+                // defect verbatim: a duration field that measures nothing.
+                elapsedMs: Date.now() - reprobeStartedAt,
+                latched: false,
+                hostStallMs: reprobeHostStallMs,
+                ...(retryAfterMs > 0 && { retryAfterMs }),
+                budgetMs: 5000,
+            });
+            return false;
+        }
         this.log("govulncheck auto-install succeeded but binary not locatable — check $GOBIN / $GOPATH");
         this.available = false;
         return false;

package/node_modules/pi-lens/dist/clients/grammar-source.js

@@ -11,6 +11,7 @@
  */
 import * as fs from "node:fs";
 import * as path from "node:path";
+import { writeFileAtomic } from "./atomic-write.js";
 /** tree-sitter-wasms release the grammars are pulled from. */
 export const TREE_SITTER_WASMS_VERSION = "0.1.13";
 /** unpkg mirror of the tree-sitter-wasms artifacts. */
@@ -110,11 +111,18 @@ export function grammarBlockReason(filename, rt = currentGrammarRuntime()) {
     return block?.blocked(rt) ? block.reason : null;
 }
 /**
- * Fetch one grammar wasm into `destDir` (atomic via a temp file). Returns true
+ * Fetch one grammar wasm into `destDir`, staged and renamed via
+ * `atomic-write.ts` so a reader never sees a half-written wasm. Returns true
  * on success. Never throws — a failed fetch (offline, 4xx) degrades to "grammar
  * unavailable" so callers can decide how to handle it. A grammar that crashes the
  * runtime is protected at LOAD time (BLOCKED_GRAMMARS / grammarBlockReason), not
  * by refusing to download it.
+ *
+ * #1217: the staging name used to be hand-rolled `.${filename}.${pid}.tmp` —
+ * per-process, so two concurrent fetches of one grammar shared a staging inode
+ * (#1205). `tree-sitter-client.ts` de-dupes in-flight fetches per grammar file,
+ * which made that hard to reach through the runtime path but did not cover
+ * direct callers.
  */
 export async function downloadGrammar(destDir, filename) {
     try {
@@ -123,9 +131,9 @@ export async function downloadGrammar(destDir, filename) {
         if (!res.ok)
             throw new Error(`HTTP ${res.status}`);
         const data = Buffer.from(await res.arrayBuffer());
-        const tmp = path.join(destDir, `.${filename}.${process.pid}.tmp`);
-        fs.writeFileSync(tmp, data);
-        fs.renameSync(tmp, path.join(destDir, filename));
+        // bestEffort: false — a swallowed write failure would return true for a
+        // grammar that never landed.
+        writeFileAtomic(path.join(destDir, filename), data, { bestEffort: false });
         return true;
     }
     catch {

package/node_modules/pi-lens/dist/clients/gzip-stage-write.js

@@ -4,10 +4,12 @@ import { Readable } from "node:stream";
 import { pipeline } from "node:stream/promises";
 import { parentPort } from "node:worker_threads";
 import { createGzip } from "node:zlib";
+import { stagePathFor } from "./atomic-write-staging.js";
 /**
  * Shared worker-thread body-persist core (#958, single source of truth #883):
- * `JSON.stringify` → chunked `createGzip` pipeline → `<stagePath>.tmp-<pid>` →
- * atomic rename to `stagePath`, returning byte/timing metrics. Both
+ * `JSON.stringify` → chunked `createGzip` pipeline → a per-call staging file
+ * from `atomic-write.ts`'s {@link stagePathFor} → atomic rename to
+ * `stagePath`, returning byte/timing metrics. Both
  * `clients/review-graph/persist-worker.ts` and
  * `clients/project-snapshot-persist-worker.ts` call this so the streamed-gzip
  * write lives in exactly one place; each worker's `parentPort` wiring owns its
@@ -19,9 +21,25 @@ import { createGzip } from "node:zlib";
  * On failure the partial `.tmp` is removed and the error is rethrown for the
  * caller to record; the `stagePath` itself is only ever created by the atomic
  * rename, so a crash mid-write can never leave a torn stage file behind.
+ *
+ * That crash-safety is NOT the same as concurrency isolation, and this
+ * docstring used to conflate the two (#1217). The staging name is what keeps
+ * two concurrent calls on one `stagePath` from writing into a shared inode,
+ * and it has to come from `stagePathFor` rather than a local
+ * `${stagePath}.tmp-${process.pid}`: this module runs on worker threads, which
+ * share `process.pid` with the main thread and with each other, so pid alone
+ * isolates nothing here (#1205's per-pid tear, verbatim). Callers normally
+ * pass a per-generation `stagePath`, which makes the overlap rare — a retry, a
+ * re-queued persist, a repeated generation, or a future non-generational
+ * caller makes it exact. Beyond tear-freedom this offers nothing: two calls on
+ * one `stagePath` are still unordered and last-rename-wins on POSIX — on
+ * Windows, MoveFileEx's REPLACE_EXISTING does not serialize concurrent replaces
+ * of the same destination, so one rename can fail with EPERM instead, which
+ * the caller must treat as a persist failure (both persist workers fall back
+ * to a main-thread rewrite on an error result).
  */
 export async function writeGzipStageFile(data, stagePath, testDelayMs) {
-    const tmpPath = `${stagePath}.tmp-${process.pid}`;
+    const tmpPath = stagePathFor(stagePath);
     try {
         if (testDelayMs) {
             await new Promise((resolve) => setTimeout(resolve, testDelayMs));

package/node_modules/pi-lens/dist/clients/host-ports.js

@@ -0,0 +1,31 @@
+/** Host-neutral capabilities available to the pi-lens engine (#1358 S2). */
+/**
+ * Headless/test implementation. Its feature-detection defaults deliberately
+ * match the pre-ports absent-host paths: unknown trust/mode, fail-open spawn,
+ * and no-op delivery surfaces.
+ */
+export function createDefaultHostPorts(overrides = {}) {
+    const unknownMode = () => "unknown";
+    const defaults = {
+        notify: { user: () => { } },
+        trust: { isProjectTrusted: () => "unknown" },
+        mode: {
+            current: unknownMode,
+            supportsTuiWidget: () => true,
+            suppressesUserNotify: () => false,
+        },
+        log: { extension: () => { }, debug: () => { }, sink: () => () => { } },
+        emit: { bus: () => { } },
+        status: { set: () => { } },
+        spawn: { abortSignal: () => undefined, isAllowed: () => true },
+        render: { invalidate: () => { } },
+        session: { id: () => undefined },
+        workspace: { cwd: () => undefined, projectRoot: () => undefined },
+        flags: { get: () => undefined },
+        tools: { has: async () => false, getActive: () => [], setActive: () => { } },
+    };
+    return Object.fromEntries(Object.entries(defaults).map(([group, value]) => [
+        group,
+        { ...value, ...(overrides[group] ?? {}) },
+    ]));
+}