@isac322/pi-codegraph 0.2.0

package/lib/codegraph.mjs

@@ -0,0 +1,415 @@
+import { createHash } from "node:crypto";
+import { createRequire } from "node:module";
+import { spawn, execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { access, lstat, mkdir, readFile, realpath, readdir, rename, rm, stat, symlink, writeFile } from "node:fs/promises";
+import os from "node:os";
+
+const execFileAsync = promisify(execFile);
+const require = createRequire(import.meta.url);
+const metadataName = ".pi-codegraph.json";
+const emptyFilesMarker = "No files found matching the criteria.";
+
+export function sanitizeDiagnostic(value, maxLength = 2_000) {
+  const clean = String(value || "")
+    .replace(/\u001b\[[0-9;]*m/g, "")
+    .replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY|APIKEY|AUTH)[A-Z0-9_]*=)\S+/gi, "$1[redacted]")
+    .replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, "Bearer [redacted]")
+    .replace(/--(?:token|secret|password|api-key|apikey|otp)(?:=|\s+)\S+/gi, "--[redacted]");
+  return clean.length > maxLength ? `${clean.slice(0, maxLength)}...` : clean;
+}
+
+export function truncateText(value, maxChars) {
+  const text = String(value ?? "");
+  if (text.length <= maxChars) return { text, truncated: false };
+  const marker = "\n\n[pi-codegraph output truncated]\n\n";
+  const headLength = Math.floor((maxChars - marker.length) * 0.75);
+  const tailLength = Math.max(0, maxChars - marker.length - headLength);
+  return { text: `${text.slice(0, headLength)}${marker}${text.slice(-tailLength)}`, truncated: true };
+}
+
+export function normalizeFilesPath(inputPath, projectCwd) {
+  if (typeof inputPath !== "string" || !inputPath.trim()) return undefined;
+  let expanded = inputPath.trim();
+  if (expanded === "~" || expanded.startsWith("~/")) expanded = join(os.homedir(), expanded.slice(1));
+  if (projectCwd && isAbsolute(expanded)) {
+    const rel = relative(projectCwd, expanded);
+    if (!rel) return undefined;
+    if (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel)) return rel.split(sep).join("/");
+  }
+  return expanded.split(sep).join("/");
+}
+
+export function annotateFilesResult(text, originalPath) {
+  if (!originalPath || !String(text).includes(emptyFilesMarker)) return text;
+  return `${text}\n\nHint: codegraph_files expects a repo-relative POSIX prefix such as \"src/components\". The path \"${originalPath}\" did not match the index.`;
+}
+
+async function existingDirectory(input) {
+  const resolved = await realpath(resolve(input));
+  const info = await stat(resolved);
+  if (!info.isDirectory()) throw new Error(`Project path is not a directory: ${input}`);
+  return resolved;
+}
+
+async function gitValue(cwd, args) {
+  try {
+    const { stdout } = await execFileAsync("git", ["-C", cwd, ...args], { timeout: 5_000 });
+    return stdout.trim();
+  } catch {
+    return "";
+  }
+}
+
+export async function gitIdentity(input) {
+  const sourcePath = await existingDirectory(input);
+  const top = await gitValue(sourcePath, ["rev-parse", "--show-toplevel"]);
+  if (!top) {
+    const info = await stat(sourcePath);
+    return {
+      sourcePath,
+      repoRoot: sourcePath,
+      repoIdentity: `directory:${sourcePath}:${info.dev}:${info.ino}:${info.birthtimeMs}`,
+      worktreeIdentity: `directory:${sourcePath}:${info.dev}:${info.ino}`,
+      gitCommonDir: "",
+    };
+  }
+  const repoRoot = await realpath(top);
+  const commonRaw = await gitValue(repoRoot, ["rev-parse", "--git-common-dir"]);
+  const gitDirRaw = await gitValue(repoRoot, ["rev-parse", "--git-dir"]);
+  const common = await realpath(isAbsolute(commonRaw) ? commonRaw : resolve(repoRoot, commonRaw));
+  const gitDir = await realpath(isAbsolute(gitDirRaw) ? gitDirRaw : resolve(repoRoot, gitDirRaw));
+  const [rootCommits, remote, commonInfo, gitDirInfo, sourceInfo] = await Promise.all([
+    gitValue(repoRoot, ["rev-list", "--max-parents=0", "HEAD"]),
+    gitValue(repoRoot, ["config", "--get", "remote.origin.url"]),
+    stat(common),
+    stat(gitDir),
+    stat(repoRoot),
+  ]);
+  const repoIdentity = createHash("sha256").update([common, rootCommits, remote, commonInfo.dev, commonInfo.ino, commonInfo.birthtimeMs].join("\0")).digest("hex");
+  const worktreeIdentity = createHash("sha256").update([gitDir, gitDirInfo.dev, gitDirInfo.ino, repoRoot, sourceInfo.dev, sourceInfo.ino].join("\0")).digest("hex");
+  return { sourcePath: repoRoot, repoRoot, repoIdentity, worktreeIdentity, gitCommonDir: common };
+}
+
+function isWithin(child, parent) {
+  const rel = relative(parent, child);
+  return rel === "" || (!rel.startsWith(`..${sep}`) && rel !== ".." && !isAbsolute(rel));
+}
+
+export class ProjectGuard {
+  static async create(baseRoot, settings) {
+    if (process.env.PI_CODEGRAPH_TRUSTED === "0") throw new Error("CodeGraph is disabled for an untrusted project.");
+    const base = await gitIdentity(baseRoot);
+    const allowedRoots = [];
+    for (const root of [base.sourcePath, ...settings.allowedProjectRoots]) {
+      try {
+        allowedRoots.push(await existingDirectory(root));
+      } catch {
+        // Ignore unavailable optional roots.
+      }
+    }
+    return new ProjectGuard(base, allowedRoots);
+  }
+
+  constructor(base, allowedRoots) {
+    this.base = base;
+    this.allowedRoots = allowedRoots;
+  }
+
+  async resolve(requestedPath) {
+    if (requestedPath && !isAbsolute(requestedPath)) throw new Error("CodeGraph projectPath must be absolute.");
+    const identity = await gitIdentity(requestedPath || this.base.sourcePath);
+    if (this.allowedRoots.some((root) => isWithin(identity.sourcePath, root))) return identity;
+    if (this.base.gitCommonDir && identity.gitCommonDir === this.base.gitCommonDir) return identity;
+    throw new Error(`CodeGraph projectPath is outside the trusted workspace and registered worktrees: ${identity.sourcePath}`);
+  }
+}
+
+async function locatePackageJson(entry) {
+  let current = dirname(entry);
+  for (;;) {
+    const candidate = join(current, "package.json");
+    try {
+      const parsed = JSON.parse(await readFile(candidate, "utf8"));
+      if (parsed.name === "@colbymchenry/codegraph") return { path: candidate, parsed };
+    } catch {
+      // Continue toward the filesystem root.
+    }
+    const parent = dirname(current);
+    if (parent === current) return undefined;
+    current = parent;
+  }
+}
+
+export async function resolveCodeGraphLaunch(settings, args = []) {
+  if (settings.codegraphExecutable) return { command: settings.codegraphExecutable, args };
+  try {
+    let packageJson;
+    try {
+      const packagePath = require.resolve("@colbymchenry/codegraph/package.json");
+      packageJson = { path: packagePath, parsed: JSON.parse(await readFile(packagePath, "utf8")) };
+    } catch {
+      packageJson = await locatePackageJson(require.resolve("@colbymchenry/codegraph"));
+    }
+    const binValue = typeof packageJson?.parsed?.bin === "string" ? packageJson.parsed.bin : packageJson?.parsed?.bin?.codegraph;
+    if (binValue) return { command: process.execPath, args: [resolve(dirname(packageJson.path), binValue), ...args] };
+  } catch {
+    // Fall through to a global executable.
+  }
+  return { command: "codegraph", args };
+}
+
+export async function runCodeGraph(settings, cwd, args, options = {}) {
+  const launch = await resolveCodeGraphLaunch(settings, args);
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(launch.command, launch.args, { cwd, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let settled = false;
+    const finish = (error, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      options.signal?.removeEventListener("abort", onAbort);
+      error ? reject(error) : resolvePromise(value);
+    };
+    const onAbort = () => {
+      child.kill();
+      const error = new Error(`codegraph ${args[0]} aborted`);
+      error.name = "AbortError";
+      finish(error);
+    };
+    child.stdout.on("data", (chunk) => { stdout += chunk.toString("utf8"); });
+    child.stderr.on("data", (chunk) => { stderr += chunk.toString("utf8"); });
+    child.on("error", finish);
+    child.on("exit", (code) => {
+      if (code === 0) finish(undefined, { stdout, stderr });
+      else finish(new Error(sanitizeDiagnostic(stderr) || `codegraph ${args[0]} exited with code ${code}`));
+    });
+    const timeoutMs = options.timeoutMs || settings.requestTimeoutMs;
+    const timer = setTimeout(() => {
+      child.kill();
+      const error = new Error(`codegraph ${args[0]} timed out after ${timeoutMs}ms`);
+      error.code = "ETIMEDOUT";
+      finish(error);
+    }, timeoutMs);
+    timer.unref?.();
+    options.signal?.addEventListener("abort", onAbort, { once: true });
+  });
+}
+
+async function exists(input) {
+  try {
+    await access(input);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+async function readMetadata(indexPath) {
+  try {
+    return JSON.parse(await readFile(join(indexPath, metadataName), "utf8"));
+  } catch {
+    return undefined;
+  }
+}
+
+async function writeMetadata(indexPath, metadata) {
+  const target = join(indexPath, metadataName);
+  const temporary = `${target}.${process.pid}.tmp`;
+  await writeFile(temporary, `${JSON.stringify(metadata, null, 2)}\n`, { mode: 0o600 });
+  await rename(temporary, target);
+}
+
+async function acquireLock(lockPath, timeoutMs = 30_000) {
+  await mkdir(dirname(lockPath), { recursive: true });
+  const started = Date.now();
+  for (;;) {
+    try {
+      await mkdir(lockPath);
+      return async () => rm(lockPath, { recursive: true, force: true });
+    } catch (error) {
+      if (error?.code !== "EEXIST") throw error;
+      try {
+        const info = await stat(lockPath);
+        if (Date.now() - info.mtimeMs > timeoutMs * 2) await rm(lockPath, { recursive: true, force: true });
+      } catch {
+        // Another owner released the lock.
+      }
+      if (Date.now() - started >= timeoutMs) throw new Error(`Timed out waiting for CodeGraph index lock: ${lockPath}`);
+      await new Promise((resolvePromise) => setTimeout(resolvePromise, 100));
+    }
+  }
+}
+
+export class WorkspaceManager {
+  constructor(settings) {
+    this.settings = settings;
+    this.lastSync = new Map();
+    this.lastGc = 0;
+  }
+
+  async prepare(identity, options = {}) {
+    await existingDirectory(identity.sourcePath);
+    const key = createHash("sha256").update(`${identity.repoIdentity}\0${identity.worktreeIdentity}\0${identity.sourcePath}`).digest("hex");
+    const managedIndex = join(this.settings.indexStore, "projects", key);
+    const lockPath = join(this.settings.indexStore, "locks", `${key}.lock`);
+    const release = await acquireLock(lockPath, this.settings.requestTimeoutMs);
+    try {
+      await existingDirectory(identity.sourcePath);
+      const binding = await this.#bind(identity, managedIndex);
+      const database = join(binding.indexPath, "codegraph.db");
+      if (!(await exists(database))) await runCodeGraph(this.settings, identity.sourcePath, ["init", "-i"], options);
+      const lastSync = this.lastSync.get(identity.sourcePath) || 0;
+      const shouldSync = (options.forceSync || this.settings.autoSync) && (options.forceSync || Date.now() - lastSync >= this.settings.syncMinIntervalMs);
+      if (shouldSync) {
+        await existingDirectory(identity.sourcePath);
+        await runCodeGraph(this.settings, identity.sourcePath, ["sync"], options);
+        this.lastSync.set(identity.sourcePath, Date.now());
+      }
+      const metadata = {
+        schemaVersion: 2,
+        sourcePath: identity.sourcePath,
+        repoIdentity: identity.repoIdentity,
+        worktreeIdentity: identity.worktreeIdentity,
+        managed: binding.managed,
+        lastPreparedAt: new Date().toISOString(),
+        lastSyncAt: this.lastSync.get(identity.sourcePath) || null,
+      };
+      await writeMetadata(binding.indexPath, metadata);
+      return { ...metadata, indexPath: binding.indexPath, state: "ready" };
+    } finally {
+      await release();
+    }
+  }
+
+  async #bind(identity, managedIndex) {
+    const linkPath = join(identity.sourcePath, ".codegraph");
+    await mkdir(managedIndex, { recursive: true });
+    try {
+      const info = await lstat(linkPath);
+      if (info.isSymbolicLink()) {
+        let target;
+        try { target = await realpath(linkPath); } catch { target = ""; }
+        if (target === managedIndex) return { indexPath: managedIndex, managed: true };
+        const metadata = target ? await readMetadata(target) : undefined;
+        if (metadata?.managed && metadata.sourcePath === identity.sourcePath) {
+          await rm(linkPath, { force: true });
+        } else {
+          throw new Error(`Refusing to replace an unmanaged .codegraph symlink at ${identity.sourcePath}`);
+        }
+      } else if (info.isDirectory()) {
+        const metadata = await readMetadata(linkPath);
+        if (metadata && (metadata.repoIdentity !== identity.repoIdentity || metadata.worktreeIdentity !== identity.worktreeIdentity)) {
+          throw new Error(`Existing .codegraph belongs to a different repository identity: ${linkPath}`);
+        }
+        return { indexPath: linkPath, managed: false };
+      } else {
+        throw new Error(`Expected .codegraph to be a directory or symlink: ${linkPath}`);
+      }
+    } catch (error) {
+      if (error?.code !== "ENOENT") throw error;
+    }
+    await existingDirectory(identity.sourcePath);
+    const temporary = `${linkPath}.pi-codegraph-${process.pid}`;
+    await rm(temporary, { force: true });
+    await symlink(managedIndex, temporary, "dir");
+    try {
+      await rename(temporary, linkPath);
+    } catch (error) {
+      await rm(temporary, { force: true });
+      if (error?.code !== "EEXIST" && error?.code !== "ENOTEMPTY") throw error;
+    }
+    return { indexPath: await realpath(linkPath), managed: true };
+  }
+
+  async status(identity) {
+    const linkPath = join(identity.sourcePath, ".codegraph");
+    try {
+      const indexPath = await realpath(linkPath);
+      const metadata = await readMetadata(indexPath);
+      return {
+        state: (await exists(join(indexPath, "codegraph.db"))) ? "ready" : "uninitialized",
+        sourcePath: identity.sourcePath,
+        indexPath,
+        managed: metadata?.managed ?? false,
+        lastSyncAt: metadata?.lastSyncAt || null,
+        identityMatches: !metadata || (metadata.repoIdentity === identity.repoIdentity && metadata.worktreeIdentity === identity.worktreeIdentity),
+      };
+    } catch {
+      return { state: "missing", sourcePath: identity.sourcePath, indexPath: null, managed: false, lastSyncAt: null, identityMatches: true };
+    }
+  }
+
+  async doctor(identity) {
+    const version = await runCodeGraph(this.settings, identity.sourcePath, ["--version"]);
+    return { executable: version.stdout.trim() || version.stderr.trim(), workspace: await this.status(identity), settings: publicSettings(this.settings) };
+  }
+
+  async gc(activeProjects = new Set(), force = false) {
+    if (!this.settings.autoGc && !force) return { removed: [] };
+    if (!force && Date.now() - this.lastGc < 60 * 60_000) return { removed: [] };
+    this.lastGc = Date.now();
+    const projectsRoot = join(this.settings.indexStore, "projects");
+    let entries = [];
+    try { entries = await readdir(projectsRoot, { withFileTypes: true }); } catch { return { removed: [] }; }
+    const removed = [];
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const indexPath = join(projectsRoot, entry.name);
+      const metadata = await readMetadata(indexPath);
+      if (!metadata?.managed || activeProjects.has(metadata.sourcePath)) continue;
+      let stale = !(await exists(metadata.sourcePath));
+      if (!stale) {
+        try {
+          const identity = await gitIdentity(metadata.sourcePath);
+          stale = identity.repoIdentity !== metadata.repoIdentity || identity.worktreeIdentity !== metadata.worktreeIdentity;
+        } catch {
+          stale = true;
+        }
+      }
+      if (stale) {
+        await rm(indexPath, { recursive: true, force: true });
+        removed.push(indexPath);
+      }
+    }
+    return { removed };
+  }
+}
+
+export async function workspaceSummary(cwd) {
+  try {
+    const identity = await gitIdentity(cwd);
+    const linkPath = join(identity.sourcePath, ".codegraph");
+    const indexPath = await realpath(linkPath);
+    const metadata = await readMetadata(indexPath);
+    return {
+      state: (await exists(join(indexPath, "codegraph.db"))) ? "ready" : "uninitialized",
+      sourcePath: identity.sourcePath,
+      indexPath,
+      lastSyncAt: metadata?.lastSyncAt || null,
+      identityMatches: !metadata || (metadata.repoIdentity === identity.repoIdentity && metadata.worktreeIdentity === identity.worktreeIdentity),
+    };
+  } catch {
+    return { state: "missing", sourcePath: resolve(cwd), indexPath: null, lastSyncAt: null, identityMatches: true };
+  }
+}
+
+export function publicSettings(settings) {
+  return {
+    autoSync: settings.autoSync,
+    autoGc: settings.autoGc,
+    indexStore: settings.indexStore,
+    workerIdleTimeoutMs: settings.workerIdleTimeoutMs,
+    maxWorkers: settings.maxWorkers,
+    requestTimeoutMs: settings.requestTimeoutMs,
+    syncMinIntervalMs: settings.syncMinIntervalMs,
+    maxOutputChars: settings.maxOutputChars,
+    allowedProjectRoots: settings.allowedProjectRoots,
+    promptInjection: settings.promptInjection,
+    codegraphExecutable: settings.codegraphExecutable || "auto",
+    configFile: settings.configFile,
+  };
+}

package/lib/config.mjs

@@ -0,0 +1,103 @@
+import os from "node:os";
+import path from "node:path";
+import { readFile } from "node:fs/promises";
+
+const configHome = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config");
+const cacheHome = process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache");
+
+export const defaultSettings = Object.freeze({
+  autoSync: true,
+  autoGc: true,
+  indexStore: path.join(cacheHome, "pi-codegraph"),
+  workerIdleTimeoutMs: 5 * 60_000,
+  maxWorkers: 6,
+  requestTimeoutMs: 30_000,
+  syncMinIntervalMs: 15_000,
+  maxOutputChars: 60_000,
+  allowedProjectRoots: [],
+  promptInjection: true,
+  codegraphExecutable: "",
+  configFile: path.join(configHome, "pi-codegraph", "config.json"),
+});
+
+function booleanValue(value, fallback) {
+  if (typeof value === "boolean") return value;
+  if (typeof value !== "string") return fallback;
+  if (["1", "true", "yes", "on"].includes(value.toLowerCase())) return true;
+  if (["0", "false", "no", "off"].includes(value.toLowerCase())) return false;
+  return fallback;
+}
+
+function integerValue(value, fallback, minimum = 0) {
+  const parsed = Number.parseInt(String(value ?? ""), 10);
+  return Number.isFinite(parsed) && parsed >= minimum ? parsed : fallback;
+}
+
+function stringArray(value, fallback = []) {
+  if (Array.isArray(value)) return value.filter((item) => typeof item === "string" && item.trim()).map((item) => item.trim());
+  if (typeof value === "string" && value.trim()) return value.split(path.delimiter).map((item) => item.trim()).filter(Boolean);
+  return fallback;
+}
+
+function normalizeSettings(input) {
+  return {
+    autoSync: booleanValue(input.autoSync, defaultSettings.autoSync),
+    autoGc: booleanValue(input.autoGc, defaultSettings.autoGc),
+    indexStore: path.resolve(String(input.indexStore || defaultSettings.indexStore)),
+    workerIdleTimeoutMs: integerValue(input.workerIdleTimeoutMs, defaultSettings.workerIdleTimeoutMs, 1_000),
+    maxWorkers: integerValue(input.maxWorkers, defaultSettings.maxWorkers, 1),
+    requestTimeoutMs: integerValue(input.requestTimeoutMs, defaultSettings.requestTimeoutMs, 1_000),
+    syncMinIntervalMs: integerValue(input.syncMinIntervalMs, defaultSettings.syncMinIntervalMs, 0),
+    maxOutputChars: integerValue(input.maxOutputChars, defaultSettings.maxOutputChars, 4_000),
+    allowedProjectRoots: stringArray(input.allowedProjectRoots).map((root) => path.resolve(root)),
+    promptInjection: booleanValue(input.promptInjection, defaultSettings.promptInjection),
+    codegraphExecutable: typeof input.codegraphExecutable === "string" ? input.codegraphExecutable.trim() : "",
+    configFile: String(input.configFile || defaultSettings.configFile),
+  };
+}
+
+export async function loadSettings(overrides = {}) {
+  const configFile = process.env.PI_CODEGRAPH_CONFIG || overrides.configFile || defaultSettings.configFile;
+  let fileSettings = {};
+  try {
+    fileSettings = JSON.parse(await readFile(configFile, "utf8"));
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw new Error(`Invalid pi-codegraph config at ${configFile}: ${error.message}`);
+  }
+
+  const environment = {
+    autoSync: process.env.PI_CODEGRAPH_AUTO_SYNC,
+    autoGc: process.env.PI_CODEGRAPH_AUTO_GC,
+    indexStore: process.env.PI_CODEGRAPH_INDEX_STORE,
+    workerIdleTimeoutMs: process.env.PI_CODEGRAPH_WORKER_IDLE_MS,
+    maxWorkers: process.env.PI_CODEGRAPH_MAX_WORKERS,
+    requestTimeoutMs: process.env.PI_CODEGRAPH_REQUEST_TIMEOUT_MS,
+    syncMinIntervalMs: process.env.PI_CODEGRAPH_SYNC_MIN_INTERVAL_MS,
+    maxOutputChars: process.env.PI_CODEGRAPH_MAX_OUTPUT_CHARS,
+    allowedProjectRoots: process.env.PI_CODEGRAPH_ALLOWED_ROOTS,
+    promptInjection: process.env.PI_CODEGRAPH_PROMPT_INJECTION,
+    codegraphExecutable: process.env.PI_CODEGRAPH_EXECUTABLE,
+    configFile,
+  };
+
+  const compactEnvironment = Object.fromEntries(Object.entries(environment).filter(([, value]) => value !== undefined));
+  return normalizeSettings({ ...defaultSettings, ...fileSettings, ...compactEnvironment, ...overrides, configFile });
+}
+
+export function settingsEnvironment(settings, baseRoot, trusted = true) {
+  return {
+    PI_CODEGRAPH_BASE_ROOT: baseRoot,
+    PI_CODEGRAPH_TRUSTED: trusted ? "1" : "0",
+    PI_CODEGRAPH_AUTO_SYNC: String(settings.autoSync),
+    PI_CODEGRAPH_AUTO_GC: String(settings.autoGc),
+    PI_CODEGRAPH_INDEX_STORE: settings.indexStore,
+    PI_CODEGRAPH_WORKER_IDLE_MS: String(settings.workerIdleTimeoutMs),
+    PI_CODEGRAPH_MAX_WORKERS: String(settings.maxWorkers),
+    PI_CODEGRAPH_REQUEST_TIMEOUT_MS: String(settings.requestTimeoutMs),
+    PI_CODEGRAPH_SYNC_MIN_INTERVAL_MS: String(settings.syncMinIntervalMs),
+    PI_CODEGRAPH_MAX_OUTPUT_CHARS: String(settings.maxOutputChars),
+    PI_CODEGRAPH_ALLOWED_ROOTS: settings.allowedProjectRoots.join(path.delimiter),
+    PI_CODEGRAPH_PROMPT_INJECTION: String(settings.promptInjection),
+    ...(settings.codegraphExecutable ? { PI_CODEGRAPH_EXECUTABLE: settings.codegraphExecutable } : {}),
+  };
+}

package/lib/jsonrpc.mjs

@@ -0,0 +1,90 @@
+export class JsonRpcPeer {
+  constructor(readable, writable, options = {}) {
+    this.readable = readable;
+    this.writable = writable;
+    this.name = options.name || "JSON-RPC peer";
+    this.nextId = 1;
+    this.pending = new Map();
+    this.buffer = "";
+    this.closed = false;
+    readable.on("data", (chunk) => this.#onData(chunk));
+    readable.on("error", (error) => this.close(error));
+    readable.on("end", () => this.close(new Error(`${this.name} closed`)));
+  }
+
+  request(method, params = {}, options = {}) {
+    if (this.closed) return Promise.reject(new Error(`${this.name} is closed`));
+    const id = this.nextId++;
+    const timeoutMs = options.timeoutMs || 30_000;
+    return new Promise((resolve, reject) => {
+      let timer;
+      const finish = (error, value) => {
+        clearTimeout(timer);
+        options.signal?.removeEventListener("abort", onAbort);
+        this.pending.delete(id);
+        error ? reject(error) : resolve(value);
+      };
+      const onAbort = () => {
+        this.notify("notifications/cancelled", { requestId: id, reason: "aborted" });
+        const error = new Error(`${method} aborted`);
+        error.name = "AbortError";
+        finish(error);
+      };
+      timer = setTimeout(() => {
+        this.notify("notifications/cancelled", { requestId: id, reason: "timeout" });
+        const error = new Error(`${method} timed out after ${timeoutMs}ms`);
+        error.code = "ETIMEDOUT";
+        finish(error);
+      }, timeoutMs);
+      timer.unref?.();
+      options.signal?.addEventListener("abort", onAbort, { once: true });
+      this.pending.set(id, { finish });
+      this.#write({ jsonrpc: "2.0", id, method, params });
+    });
+  }
+
+  notify(method, params = {}) {
+    if (!this.closed) this.#write({ jsonrpc: "2.0", method, params });
+  }
+
+  close(error = new Error(`${this.name} closed`)) {
+    if (this.closed) return;
+    this.closed = true;
+    for (const pending of this.pending.values()) pending.finish(error);
+    this.pending.clear();
+  }
+
+  #write(message) {
+    try {
+      this.writable.write(`${JSON.stringify(message)}\n`);
+    } catch (error) {
+      this.close(error);
+    }
+  }
+
+  #onData(chunk) {
+    this.buffer += chunk.toString("utf8");
+    let newline;
+    while ((newline = this.buffer.indexOf("\n")) !== -1) {
+      const line = this.buffer.slice(0, newline).trim();
+      this.buffer = this.buffer.slice(newline + 1);
+      if (!line) continue;
+      let message;
+      try {
+        message = JSON.parse(line);
+      } catch {
+        continue;
+      }
+      if (message.id === undefined || (!Object.hasOwn(message, "result") && !Object.hasOwn(message, "error"))) continue;
+      const pending = this.pending.get(message.id);
+      if (!pending) continue;
+      if (message.error) {
+        const error = new Error(message.error.message || JSON.stringify(message.error));
+        error.code = message.error.code;
+        pending.finish(error);
+      } else {
+        pending.finish(undefined, message.result);
+      }
+    }
+  }
+}

package/lib/pi-mcp-client.mjs

@@ -0,0 +1,68 @@
+import { spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+import { JsonRpcPeer } from "./jsonrpc.mjs";
+import { sanitizeDiagnostic } from "./codegraph.mjs";
+import { settingsEnvironment } from "./config.mjs";
+
+const serverPath = fileURLToPath(new URL("../bin/codegraph-mcp.mjs", import.meta.url));
+
+export class PiCodeGraphClient {
+  constructor(settings, baseRoot) {
+    this.settings = settings;
+    this.baseRoot = baseRoot;
+    this.startPromise = undefined;
+    this.child = undefined;
+    this.peer = undefined;
+  }
+
+  async start() {
+    if (this.peer) return;
+    if (this.startPromise) return this.startPromise;
+    this.startPromise = this.#start().finally(() => { this.startPromise = undefined; });
+    return this.startPromise;
+  }
+
+  async #start() {
+    const child = spawn(process.execPath, [serverPath], {
+      cwd: this.baseRoot,
+      env: { ...process.env, ...settingsEnvironment(this.settings, this.baseRoot, true) },
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    let stderr = "";
+    child.stderr.on("data", (chunk) => { stderr = `${stderr}${chunk.toString("utf8")}`.slice(-8_000); });
+    const peer = new JsonRpcPeer(child.stdout, child.stdin, { name: "pi-codegraph MCP facade" });
+    child.on("error", (error) => peer.close(error));
+    child.on("exit", (code) => peer.close(new Error(sanitizeDiagnostic(stderr) || `pi-codegraph MCP facade exited with code ${code}`)));
+    this.child = child;
+    this.peer = peer;
+    try {
+      await peer.request("initialize", {
+        protocolVersion: "2024-11-05",
+        capabilities: {},
+        clientInfo: { name: "pi-codegraph-pi", version: "0.2.0" },
+      }, { timeoutMs: this.settings.requestTimeoutMs });
+      peer.notify("initialized", {});
+    } catch (error) {
+      await this.close();
+      throw error;
+    }
+  }
+
+  async request(method, params = {}, signal) {
+    await this.start();
+    return this.peer.request(method, params, { signal, timeoutMs: this.settings.requestTimeoutMs });
+  }
+
+  async callTool(name, args, signal) {
+    return this.request("tools/call", { name, arguments: args }, signal);
+  }
+
+  async close() {
+    const peer = this.peer;
+    const child = this.child;
+    this.peer = undefined;
+    this.child = undefined;
+    peer?.close(new Error("Pi session closed"));
+    if (child && !child.killed) child.kill();
+  }
+}