@oh-my-pi/pi-coding-agent 15.7.1 → 15.7.3

package/src/extensibility/plugins/git-url.ts

@@ -25,6 +25,29 @@ const KNOWN_HOSTS: Record<string, (pathname: string, hash: string) => { user: st
 	"codeberg.org": extractStandard,
 };
 
+/**
+ * Namespaced shorthand prefixes accepted by `omp plugin install`, mapped to
+ * their canonical host. `PluginManager.install` normalizes non-GitHub prefixes
+ * before invoking bun because bun only treats `github:` as a hosted shorthand.
+ */
+const SHORTHAND_PREFIXES: Record<string, string> = {
+	github: "github.com",
+	gitlab: "gitlab.com",
+	bitbucket: "bitbucket.org",
+	codeberg: "codeberg.org",
+	sourcehut: "git.sr.ht",
+	srht: "git.sr.ht",
+};
+
+/**
+ * `<prefix>:<user>/<repo>[.git][#<ref>]` shape. `<repo>` is non-greedy so the
+ * optional `.git` suffix and `#ref` tail bind tightly; `<repo>` may itself
+ * contain `/` to support nested GitLab groups (`gitlab:group/sub/project`).
+ * `<user>` rejects `/`, `:`, `#` to keep protocol URLs (`https://…`) and
+ * scp-like SSH (`git@github.com:user/repo`) out of this path.
+ */
+const SHORTHAND_RE = /^([a-z]+):([^/:#]+)\/([^#]+?)(?:\.git)?(?:#(.+))?$/i;
+
 function stripUrlCredentials(url: string): string {
 	if (!url.includes("://")) return url;
 	try {
@@ -209,14 +232,55 @@ function parseGenericGitUrl(url: string): GitSource | null {
 	return { type: "git", repo, host, path: normalizedPath, ref, pinned: Boolean(ref) };
 }
 
+/**
+ * Match an npm/bun-style namespaced shorthand (`github:user/repo`, optionally
+ * `…#ref` or `….git`). Returns null for protocol URLs and any prefix not in
+ * `SHORTHAND_PREFIXES` so the caller can fall through to the generic paths.
+ */
+function tryNamespacedShorthand(trimmed: string): GitSource | null {
+	// Cheap gate: bail out before touching protocol URLs (`https://`, `ssh://`,
+	// `git://`) where the char after the colon is always `/`. The shorthand we
+	// care about never starts with `<scheme>://`.
+	if (!/^[a-z]+:[^/]/i.test(trimmed)) return null;
+	const match = trimmed.match(SHORTHAND_RE);
+	if (!match) return null;
+	const prefix = (match[1] ?? "").toLowerCase();
+	const host = SHORTHAND_PREFIXES[prefix];
+	if (!host) return null;
+	const user = match[2] ?? "";
+	const repoPath = match[3] ?? "";
+	if (!user || !repoPath) return null;
+	const ref = match[4];
+	if (ref) {
+		try {
+			decodeURIComponent(ref);
+		} catch {
+			return null;
+		}
+	}
+	const fullPath = `${user}/${repoPath}`;
+	return {
+		type: "git",
+		repo: `https://${host}/${fullPath}`,
+		host,
+		path: fullPath,
+		ref: ref || undefined,
+		pinned: Boolean(ref),
+	};
+}
+
 /**
  * Parse git source into a GitSource.
  *
  * Rules:
- * - With `git:` prefix, accept shorthand forms.
+ * - Namespaced shorthand (`github:user/repo`, `gitlab:`, `bitbucket:`,
+ *   `codeberg:`, `sourcehut:`/`srht:`) is accepted directly; installers should
+ *   normalize entries that bun does not understand natively.
+ * - With `git:` prefix, accept generic shorthand forms.
  * - Without `git:` prefix, only accept explicit protocol URLs.
  *
  * Handles:
+ * - `github:user/repo[#ref]`-style namespaced shorthand
  * - `git:` prefixed URLs (`git:github.com/user/repo`)
  * - SSH SCP-like URLs (`git:git@github.com:user/repo`)
  * - HTTPS/HTTP/SSH/git protocol URLs
@@ -227,10 +291,23 @@ function parseGenericGitUrl(url: string): GitSource | null {
  */
 export function parseGitUrl(source: string): GitSource | null {
 	const trimmed = source.trim();
-	const hasGitPrefix = /^git:(?!\/\/)/i.test(trimmed);
-	const url = hasGitPrefix ? trimmed.slice(4).trim() : trimmed;
 
-	if (!hasGitPrefix && !/^(https?|ssh|git):\/\//i.test(url)) {
+	const shorthand = tryNamespacedShorthand(trimmed);
+	if (shorthand) return shorthand;
+
+	// Strip the `git+` URL prefix that npm/bun accept (`git+https://…`,
+	// `git+ssh://…`, `git+git://…`). The rest of the pipeline only deals with
+	// bare schemes.
+	const stripped = /^git\+/i.test(trimmed) ? trimmed.slice(4) : trimmed;
+
+	const hasGitPrefix = /^git:(?!\/\/)/i.test(stripped);
+	const url = hasGitPrefix ? stripped.slice(4).trim() : stripped;
+
+	// Accept: explicit protocol URL, `git:` shorthand, or scp-like SSH
+	// (`git@host:user/repo`). The scp form is unambiguous — no local path
+	// starts with `git@` — and matches the syntax that `git clone` itself
+	// accepts, which `bun install` forwards through.
+	if (!hasGitPrefix && !/^(https?|ssh|git):\/\//i.test(url) && !/^git@[^:]+:.+\/.+/i.test(url)) {
 		return null;
 	}
 
@@ -279,3 +356,12 @@ export function parseGitUrl(source: string): GitSource | null {
 
 	return parseGenericGitUrl(url);
 }
+
+/**
+ * Returns true if the spec is parseable as a git source (protocol URL,
+ * scp-like SSH wrapped in `git:`, plain `git:` shorthand, or namespaced
+ * shorthand like `github:user/repo`). The inverse of "this is an npm spec".
+ */
+export function isGitSpec(spec: string): boolean {
+	return parseGitUrl(spec) !== null;
+}

package/src/extensibility/plugins/manager.ts

@@ -10,6 +10,7 @@ import {
 	isEnoent,
 	logger,
 } from "@oh-my-pi/pi-utils";
+import { type GitSource, parseGitUrl } from "./git-url";
 import { extractPackageName, parsePluginSpec } from "./parser";
 import type {
 	DoctorCheck,
@@ -29,8 +30,14 @@ import type {
 /** Valid npm package name pattern (scoped and unscoped, with optional version) */
 const VALID_PACKAGE_NAME = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*(@[a-z0-9-._^~>=<]+)?$/i;
 
+/** Characters that are never valid in any plugin install spec — git or npm. */
+const SHELL_METACHARS = /[;&|`$(){}<>\\\n\r\t]/;
+
 /**
- * Validate package name to prevent command injection.
+ * Validate package name to prevent command injection. npm specs only — git
+ * specs (`github:user/repo`, `https://github.com/...`, ...) MUST go through
+ * {@link validateGitSpec} instead because they contain characters npm rejects
+ * (`:`, `/`, `#`, `+`, `@` in non-version positions).
  */
 function validatePackageName(name: string): void {
 	// Remove version specifier for validation
@@ -44,6 +51,29 @@ function validatePackageName(name: string): void {
 	}
 }
 
+/**
+ * Validate a git install spec — accepts `:`, `/`, `#`, `+`, `.`, `-`, `_`,
+ * `~`, `@` (which would all fail {@link validatePackageName}) but rejects
+ * shell metacharacters so the spec stays safe when forwarded to bun install.
+ * `Bun.spawn` does not invoke a shell, but defense-in-depth keeps things
+ * obvious for future readers.
+ */
+function validateGitSpec(spec: string): void {
+	if (SHELL_METACHARS.test(spec)) {
+		throw new Error(`Invalid characters in plugin source: ${spec}`);
+	}
+}
+
+function gitInstallSpec(original: string, source: GitSource): string {
+	if (/^github:/i.test(original) || !/^[a-z]+:[^/]/i.test(original)) {
+		return original;
+	}
+	if (!source.ref || source.repo.includes("#")) {
+		return source.repo;
+	}
+	return `${source.repo}#${source.ref}`;
+}
+
 // =============================================================================
 // Plugin Manager
 // =============================================================================
@@ -127,12 +157,39 @@ export class PluginManager {
 		}
 	}
 
+	/**
+	 * Read the `dependencies` map from `plugins/package.json`. Returns an empty
+	 * object when the file does not exist yet so callers can diff `before`
+	 * against `after` to discover the package bun just installed under its
+	 * real name (git specs do not encode the package name in the spec itself).
+	 */
+	async #readDeps(pkgJsonPath: string): Promise<Record<string, string>> {
+		try {
+			const json = await Bun.file(pkgJsonPath).json();
+			return (json.dependencies as Record<string, string>) ?? {};
+		} catch (err) {
+			if (isEnoent(err)) return {};
+			throw err;
+		}
+	}
+
 	// ==========================================================================
 	// Install / Uninstall
 	// ==========================================================================
 
 	/**
-	 * Install a plugin from npm with optional feature selection.
+	 * Install a plugin with optional feature selection.
+	 *
+	 * Accepts:
+	 * - npm specs: `pkg`, `pkg@1.2.3`, `@scope/pkg`, `pkg[features]`
+	 * - namespaced git shorthand: `github:user/repo[#ref]`, `gitlab:`, `bitbucket:`,
+	 *   `codeberg:`, `sourcehut:`/`srht:`
+	 * - full git URLs: `https://github.com/user/repo`, `git@github.com:user/repo`,
+	 *   `ssh://…`, `git+https://…`
+	 *
+	 * For git specs the package name is not knowable from the spec, so the
+	 * installer diffs `plugins/package.json` `dependencies` before and after
+	 * to find the newly added key.
 	 *
 	 * @param specString - Package specifier with optional features: "pkg", "pkg[feat]", "pkg[*]", "pkg[]"
 	 * @param options - Install options
@@ -140,7 +197,12 @@ export class PluginManager {
 	 */
 	async install(specString: string, options: InstallOptions = {}): Promise<InstalledPlugin> {
 		const spec = parsePluginSpec(specString);
-		validatePackageName(spec.packageName);
+		const gitSource = parseGitUrl(spec.packageName);
+		if (gitSource) {
+			validateGitSpec(spec.packageName);
+		} else {
+			validatePackageName(spec.packageName);
+		}
 
 		await this.#ensurePackageJson();
 
@@ -154,9 +216,12 @@ export class PluginManager {
 				enabled: true,
 			};
 		}
+		const pkgJsonPath = getPluginsPackageJson();
+		const depsBefore = gitSource ? await this.#readDeps(pkgJsonPath) : {};
+		const packageInstallSpec = gitSource ? gitInstallSpec(spec.packageName, gitSource) : spec.packageName;
 
 		// Run npm install
-		const proc = Bun.spawn(["bun", "install", spec.packageName], {
+		const proc = Bun.spawn(["bun", "install", packageInstallSpec], {
 			cwd: getPluginsDir(),
 			stdin: "ignore",
 			stdout: "pipe",
@@ -169,9 +234,40 @@ export class PluginManager {
 			const stderr = await new Response(proc.stderr).text();
 			throw new Error(`npm install failed: ${stderr}`);
 		}
-
-		// Resolve actual package name (strip version specifier)
-		const actualName = extractPackageName(spec.packageName);
+		// Resolve actual package name. npm specs encode the name (strip version);
+		// git specs do not, so diff plugins/package.json deps to find the new entry.
+		let actualName: string;
+		if (gitSource) {
+			const depsAfter = await this.#readDeps(pkgJsonPath);
+			let resolved: string | undefined;
+			for (const key of Object.keys(depsAfter)) {
+				if (!(key in depsBefore)) {
+					resolved = key;
+					break;
+				}
+			}
+			// Fallback: a force-reinstall of an already-present git plugin will not
+			// add a new key, just rewrite the existing one to the new spec value.
+			// Match by the install value for force-reinstalls where no new key is
+			// added (non-GitHub shorthands are normalized before bun sees them).
+			if (!resolved) {
+				const needle = packageInstallSpec.replace(/^git\+/i, "");
+				for (const [key, value] of Object.entries(depsAfter)) {
+					if (typeof value === "string" && value.includes(needle)) {
+						resolved = key;
+						break;
+					}
+				}
+			}
+			if (!resolved) {
+				throw new Error(
+					`Installed ${spec.packageName} but could not determine package name from plugins/package.json`,
+				);
+			}
+			actualName = resolved;
+		} else {
+			actualName = extractPackageName(spec.packageName);
+		}
 		const pkgPath = path.join(getPluginsNodeModules(), actualName, "package.json");
 
 		let pkg: { name: string; version: string; omp?: PluginManifest; pi?: PluginManifest };

package/src/extensibility/shared-events.ts

@@ -204,13 +204,13 @@ export interface TurnEndEvent {
 export interface AutoCompactionStartEvent {
 	type: "auto_compaction_start";
 	reason: "threshold" | "overflow" | "idle" | "incomplete";
-	action: "context-full" | "handoff";
+	action: "context-full" | "handoff" | "shake" | "shake-summary";
 }
 
 /** Fired when auto-compaction ends */
 export interface AutoCompactionEndEvent {
 	type: "auto_compaction_end";
-	action: "context-full" | "handoff";
+	action: "context-full" | "handoff" | "shake" | "shake-summary";
 	result: CompactionResult | undefined;
 	aborted: boolean;
 	willRetry: boolean;