@mjasnikovs/pi-task 0.29.0 → 0.29.1

package/dist/workers/docs-core.js

@@ -106,9 +106,24 @@ export async function runAutoInstall(spawn, packageName, signal, versionRange) {
     // `shell: false` in runChild, so a `^`/`~`/space in the range stays a single
     // literal arg — no glob/expansion risk from `<pkg>@<range>`.
     const target = versionRange ? `${packageName}@${versionRange}` : packageName;
+    // `--ignore-scripts` is not optional here. The package NAME is model-chosen —
+    // it comes out of a worker's question, or out of a `/// <reference types="X" />`
+    // line in someone else's declaration file — so a hallucinated or typosquatted
+    // name would otherwise run its preinstall/postinstall as the user. This cache
+    // has already run install hooks for `node`, `argon2`, `onnxruntime-node` and
+    // `sharp`, next to fetched names like `app.ts`, `pkg.json` and `tsconfig.json`.
+    // Nothing is lost: the docs worker only ever READS `.d.ts` files and the README
+    // out of the installed tree, and those ship in the tarball.
     const result = await runChild(spawn, {
         command: 'npm',
-        args: ['install', '--no-audit', '--no-fund', '--loglevel=error', target]
+        args: [
+            'install',
+            '--ignore-scripts',
+            '--no-audit',
+            '--no-fund',
+            '--loglevel=error',
+            target
+        ]
     }, installDir, signal, { mode: 'text', discardStdout: true });
     return { success: result.exitCode === 0 && !result.aborted, installDir, stderr: result.stderr };
 }

package/dist/workers/docs-resolve.d.ts

@@ -30,9 +30,27 @@ export declare function resolvePackage(moduleName: string, cwd: string): Resolve
 export declare function typesPackageName(moduleName: string): string | null;
 /** True if the package ships at least one declaration file. */
 export declare function hasTypeFiles(root: string): boolean;
+/**
+ * Count declarations in a declaration file's text, ignoring comments, blank
+ * lines, and the pointer lines a redirect stub is made of (`/// <reference .. />`
+ * and `export * from "X"`).
+ *
+ * This is the discriminator `detectTypesRedirect` needs: a redirect stub is a
+ * file with essentially nothing in it but the pointer, while an API surface that
+ * merely *declares an ambient dependency* on another types package (the
+ * `sharp` -> `/// <reference types="node" />` shape) carries its own
+ * declarations. Counting `.d.ts` FILES cannot tell those apart — sharp ships one
+ * 1971-line file and `@types/bun` ships one 1-line file, and both count as 1.
+ *
+ * Deliberately lexical, not a TypeScript parse: this runs in the shipped worker,
+ * which has no compiler dependency. Over-counting is the safe direction (a
+ * declaration found ⇒ not a stub ⇒ keep the package's own types).
+ */
+export declare function countEntryDeclarations(content: string): number;
 /** When a package is a pure pointer to another types package — a single-file
  *  `/// <reference types="X" />` (the `@types/bun -> bun-types` shape) or a lone
  *  `export * from "X"` re-export — return the target package name. Returns null
- *  for packages that ship their own declarations (more than one .d.ts file, or a
- *  local `/// <reference path=... />` aggregator entry). */
+ *  for packages that ship their own declarations (more than one .d.ts file, a
+ *  local `/// <reference path=... />` aggregator entry, or an entry file that
+ *  declares anything of its own). */
 export declare function detectTypesRedirect(pkg: ResolvedPackage): string | null;

package/dist/workers/docs-resolve.js

@@ -223,11 +223,55 @@ function isBareSpecifier(spec) {
 }
 const REFERENCE_TYPES_RE = /\/\/\/\s*<reference\s+types=["']([^"']+)["']\s*\/>/;
 const REEXPORT_ALL_RE = /^\s*export\s+(?:type\s+)?\*\s+from\s+["']([^"']+)["'];?\s*$/m;
+const BLOCK_COMMENT_RE = /\/\*[\s\S]*?\*\//g;
+const DECLARATION_RE = /^\s*(?:export\s+(?:default\s+)?)?(?:declare\s+)?(?:abstract\s+|async\s+)?(?:interface|type|class|function|const|let|var|namespace|module|enum)\b/;
+/**
+ * Count declarations in a declaration file's text, ignoring comments, blank
+ * lines, and the pointer lines a redirect stub is made of (`/// <reference .. />`
+ * and `export * from "X"`).
+ *
+ * This is the discriminator `detectTypesRedirect` needs: a redirect stub is a
+ * file with essentially nothing in it but the pointer, while an API surface that
+ * merely *declares an ambient dependency* on another types package (the
+ * `sharp` -> `/// <reference types="node" />` shape) carries its own
+ * declarations. Counting `.d.ts` FILES cannot tell those apart — sharp ships one
+ * 1971-line file and `@types/bun` ships one 1-line file, and both count as 1.
+ *
+ * Deliberately lexical, not a TypeScript parse: this runs in the shipped worker,
+ * which has no compiler dependency. Over-counting is the safe direction (a
+ * declaration found ⇒ not a stub ⇒ keep the package's own types).
+ */
+export function countEntryDeclarations(content) {
+    const stripped = content.replace(BLOCK_COMMENT_RE, '');
+    let n = 0;
+    for (const raw of stripped.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('//'))
+            continue;
+        if (REEXPORT_ALL_RE.test(line))
+            continue;
+        if (DECLARATION_RE.test(line))
+            n++;
+    }
+    return n;
+}
+/** The package a declaration file points at: a triple-slash `<reference types>`
+ *  or a whole-module `export * from`. Null when the file points nowhere. */
+function pointerTarget(content) {
+    const ref = REFERENCE_TYPES_RE.exec(content);
+    if (ref && isBareSpecifier(ref[1]))
+        return parentPackageName(ref[1]);
+    const rex = REEXPORT_ALL_RE.exec(content);
+    if (rex && isBareSpecifier(rex[1]))
+        return parentPackageName(rex[1]);
+    return null;
+}
 /** When a package is a pure pointer to another types package — a single-file
  *  `/// <reference types="X" />` (the `@types/bun -> bun-types` shape) or a lone
  *  `export * from "X"` re-export — return the target package name. Returns null
- *  for packages that ship their own declarations (more than one .d.ts file, or a
- *  local `/// <reference path=... />` aggregator entry). */
+ *  for packages that ship their own declarations (more than one .d.ts file, a
+ *  local `/// <reference path=... />` aggregator entry, or an entry file that
+ *  declares anything of its own). */
 export function detectTypesRedirect(pkg) {
     // A package that ships multiple declaration files is an aggregator, not a
     // redirect stub — use its own types.
@@ -247,11 +291,16 @@ export function detectTypesRedirect(pkg) {
     // declarations (e.g. bun-types) — not a redirect to another package.
     if (/\/\/\/\s*<reference\s+path=/.test(content))
         return null;
-    const ref = REFERENCE_TYPES_RE.exec(content);
-    if (ref && isBareSpecifier(ref[1]))
-        return parentPackageName(ref[1]);
-    const rex = REEXPORT_ALL_RE.exec(content);
-    if (rex && isBareSpecifier(rex[1]))
-        return parentPackageName(rex[1]);
-    return null;
+    const target = pointerTarget(content);
+    if (!target)
+        return null;
+    // A pointer line is not a redirect when the file it sits in also declares an
+    // API. `/// <reference types="node" />` in a package like sharp is an AMBIENT
+    // DEPENDENCY declaration — "my types need node's" — not "my types ARE node's";
+    // following it answered every sharp question out of @types/node (tty.d.ts,
+    // zlib.d.ts) while sharp's own 1971-line surface sat one file away. The .d.ts
+    // FILE count cannot see this: sharp ships one file and so does @types/bun.
+    if (countEntryDeclarations(content) > 0)
+        return null;
+    return target;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mjasnikovs/pi-task",
-    "version": "0.29.0",
+    "version": "0.29.1",
     "description": "Deterministic task planning and spec-orchestration for local models — crash-safe /task pipelines with verify/enforce gates, a real-time remote web view, and web/docs/fetch/worker subagent tools.",
     "type": "module",
     "main": "./dist/index.js",