@herbertgao/pi-extensions 2026.8.4 → 2026.8.6

package/node_modules/pi-lens/dist/clients/security-scan-client.js

@@ -12,10 +12,34 @@
  *
  * Refs: #130, #131, #132
  */
+import { createSubsystemLogger } from "./extension-log.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { classifyProbeFailure, createAvailabilityLatch, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 export class SecurityScanClient {
     toolName;
-    available = null;
+    /**
+     * Availability memo, backed by the shared transient-aware latch (#1467).
+     *
+     * Assigning `false` still means "durable: this machine does not have the
+     * tool" — every existing subclass write keeps its meaning. A probe that
+     * merely timed out must go through `markTransientlyUnavailable` instead, so
+     * it expires and the tool can come back without a host restart.
+     */
+    availabilityLatch = createAvailabilityLatch();
+    get available() {
+        return this.availabilityLatch.read();
+    }
+    set available(value) {
+        if (value === true)
+            this.availabilityLatch.noteAvailable();
+        else if (value === false)
+            this.availabilityLatch.noteUnavailable("missing", "not-found");
+        else
+            this.availabilityLatch.reset();
+    }
+    /** Outcome/cause of the most recent `probeVersion` call. */
+    lastProbeOutcome = null;
+    lastProbeCause = null;
     ensureInFlight = null;
     inFlight = new Map();
     binaryPath = null;
@@ -27,7 +51,7 @@ export class SecurityScanClient {
     constructor(toolName, verbose = false) {
         this.toolName = toolName;
         this.log = verbose
-            ? (msg) => console.error(`[${toolName}] ${msg}`)
+            ? createSubsystemLogger(toolName)
             : () => { };
     }
     /**
@@ -50,18 +74,71 @@ export class SecurityScanClient {
     }
     /**
      * Spawn `toolName <versionArgs>` and report whether it answered cleanly.
-     * Does NOT mutate `this.available` — callers decide what a hit/miss means.
+     * Does NOT mutate `this.available` — callers decide what a hit/miss means —
+     * but it does classify the failure (`lastProbeOutcome`/`lastProbeCause`) and
+     * emit one availability-decision record, so a probe that keeps timing out is
+     * visible in latency.log rather than inferred from silence (#1467).
      */
     async probeVersion(versionArgs) {
-        const probe = await safeSpawnAsync(this.toolName, versionArgs, {
-            timeout: 5000,
-        });
+        const sampler = startHostStallSampler();
+        const startedAt = Date.now();
+        let probe;
+        let hostStallMs;
+        try {
+            probe = await safeSpawnAsync(this.toolName, versionArgs, {
+                timeout: 5000,
+            });
+        }
+        finally {
+            hostStallMs = sampler.stop();
+        }
+        const elapsedMs = Date.now() - startedAt;
         if (!probe.error && probe.status === 0) {
+            this.lastProbeOutcome = "success";
+            this.lastProbeCause = "ok";
             this.log(`${this.toolName} found: ${probe.stdout.trim().split("\n")[0]}`);
+            logAvailabilityDecision({
+                tool: this.toolName,
+                verdict: "available",
+                outcome: "success",
+                cause: "ok",
+                elapsedMs,
+                latched: true,
+                hostStallMs,
+                budgetMs: 5000,
+            });
             return true;
         }
+        const { outcome, cause } = classifyProbeFailure(probe, { hostStallMs });
+        this.lastProbeOutcome = outcome;
+        this.lastProbeCause = cause;
+        logAvailabilityDecision({
+            tool: this.toolName,
+            verdict: "unavailable",
+            outcome,
+            cause,
+            elapsedMs,
+            latched: outcome !== "transient",
+            hostStallMs,
+            budgetMs: 5000,
+        });
         return false;
     }
+    /** True when the last probe failed for a reason that is not the tool's fault. */
+    probeWasTransient() {
+        return this.lastProbeOutcome === "transient";
+    }
+    /**
+     * Record a non-durable unavailability: the verdict expires after a cooldown
+     * and the next `ensureAvailable` re-probes.
+     *
+     * Returns that cooldown in ms so the caller can put it in its decision
+     * record. A latch you can read in `latency.log` without the retry schedule
+     * beside it only tells you the tool is off, not when it comes back.
+     */
+    markTransientlyUnavailable(cause = "probe-timeout") {
+        return this.availabilityLatch.noteUnavailable("transient", cause);
+    }
     /**
      * Standard availability path for the GitHub-release tools (gitleaks, trivy):
      * PATH probe first, then fall back to the pi-lens installer's `ensureTool`.
@@ -72,6 +149,13 @@ export class SecurityScanClient {
             this.available = true;
             return true;
         }
+        if (this.probeWasTransient()) {
+            // A timed-out probe is not evidence the tool is absent, so it must not
+            // trigger an install NOR latch a permanent `false`.
+            this.log(`${this.toolName} availability probe timed out; not installing, will retry`);
+            this.markTransientlyUnavailable(this.lastProbeCause ?? "probe-timeout");
+            return false;
+        }
         this.log(`${this.toolName} not found, attempting auto-install`);
         const { ensureTool } = await import("./installer/index.js");
         const installed = await ensureTool(this.toolName);

package/node_modules/pi-lens/dist/clients/session-state-store.js

@@ -13,7 +13,7 @@ import * as path from "node:path";
 import { writeFileAtomicAsync } from "./atomic-write.js";
 import { getProjectDataDir } from "./file-utils.js";
 import { readJsonCacheAsync } from "./json-cache-read.js";
-const STATE_VERSION = 1;
+export const STATE_VERSION = 1;
 export function sessionStartMode(reason, hasPendingForkSnapshot) {
     if (reason === "fork" && hasPendingForkSnapshot)
         return "fork";
@@ -52,7 +52,8 @@ export async function saveSessionState(cwd, sessionId, widget, readGuard) {
         // bestEffort (default): a failed write/rename just means this snapshot is
         // lost, matching this store's documented "start clean" fallback — never
         // throw for the caller. (Tmp naming is now the shared
-        // `${target}.tmp-${pid}` shape rather than this site's former
+        // `${target}.tmp-${pid}-${seq}` shape (unique per call, not just per process,
+        // since #1205) rather than this site's former
         // `${file}.${pid}.tmp` — no behavioral difference: nothing reads the
         // intermediate tmp filename.)
         await writeFileAtomicAsync(file, JSON.stringify(payload));