@pi-harness/pi-harness 0.1.13 → 0.1.14

package/packages/core/src/plugins/test-harness.ts

@@ -1,67 +1,300 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
+import { spawn, type ChildProcess } from "node:child_process";
+import { isAbsolute } from "node:path";
+import { stripVTControlCharacters } from "node:util";
 import type { Context } from "@deepseek-ai/cordis";
+import z from "@deepseek-ai/schemastery";
 import { Type } from "@earendil-works/pi-ai";
 import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
+import { assertKnownConfigKeys } from "../config.js";
 
-const execFileAsync = promisify(execFile);
-const allowedScripts = new Set(["test", "build", "format:check", "lint", "typecheck"]);
-type TestRun = { script: string; command: string; exitCode: number; durationMs: number; output: string };
+const allowedScripts = ["test", "build", "format:check", "lint", "typecheck"] as const;
+const allowedScriptSet = new Set<string>(allowedScripts);
+const defaultTimeoutMs = 120_000;
+const minimumTimeoutMs = 100;
+const maximumTimeoutMs = 600_000;
+const maxOutputBytes = 12 * 1024;
+const terminationGraceMs = 1_000;
+
+type TestScript = (typeof allowedScripts)[number];
+type TestRunStatus = "passed" | "failed" | "timed-out" | "cancelled";
+
+type TestRun = {
+  script: TestScript;
+  command: string;
+  status: TestRunStatus;
+  exitCode: number | null;
+  signal: string | null;
+  durationMs: number;
+  output: string;
+  outputBytes: number;
+  outputTruncated: boolean;
+  outputSanitized: boolean;
+};
+
+export interface TestHarnessConfig {
+  timeoutMs?: number;
+}
+
+export const Config: z<TestHarnessConfig> = z.object({ timeoutMs: z.number().default(defaultTimeoutMs) });
+
+function testHarnessParameters(value: unknown): { script: TestScript } {
+  if (value === null || typeof value !== "object") throw new Error("Test harness parameters must be a plain object");
+  let descriptors: PropertyDescriptorMap;
+  let prototype: unknown;
+  let array: boolean;
+  try {
+    array = Array.isArray(value);
+    descriptors = Object.getOwnPropertyDescriptors(value);
+    prototype = Object.getPrototypeOf(value) as unknown;
+  } catch (error) {
+    throw new Error("Test harness parameters must be an accessible plain object", { cause: error });
+  }
+  if (array || (prototype !== Object.prototype && prototype !== null)) throw new Error("Test harness parameters must be a plain object");
+  if (Reflect.ownKeys(descriptors).some((key) => key !== "script")) throw new Error("Test harness parameters must contain only script");
+  const descriptor = descriptors.script;
+  if (descriptor === undefined) return { script: "test" };
+  if (!("value" in descriptor) || typeof descriptor.value !== "string") throw new Error("Test harness parameters script must be a string data property");
+  if (!allowedScriptSet.has(descriptor.value)) throw new Error("Test harness parameters script is not an approved verification script");
+  return { script: descriptor.value as TestScript };
+}
+
+function throwIfCancelled(signal: AbortSignal): void {
+  if (signal.aborted) throw new Error("Project verification was cancelled");
+}
+
+function npmInvocation(script: TestScript): { executable: string; args: string[] } {
+  const npmCli = process.env.npm_execpath;
+  if (typeof npmCli === "string" && npmCli.trim() !== "" && isAbsolute(npmCli)) {
+    return { executable: process.execPath, args: [npmCli, "run", script] };
+  }
+  if (process.platform === "win32") {
+    return { executable: process.env.ComSpec ?? "cmd.exe", args: ["/d", "/s", "/c", `npm.cmd run ${script}`] };
+  }
+  return { executable: "npm", args: ["run", script] };
+}
+
+function appendTail(current: Buffer<ArrayBufferLike>, chunk: Buffer<ArrayBufferLike>, maximum: number): Buffer<ArrayBufferLike> {
+  if (chunk.length >= maximum) return Buffer.from(chunk.subarray(chunk.length - maximum));
+  if (current.length + chunk.length <= maximum) return Buffer.concat([current, chunk], current.length + chunk.length);
+  const keep = maximum - chunk.length;
+  return Buffer.concat([current.subarray(current.length - keep), chunk], maximum);
+}
+
+function utf8Tail(value: string, maximum: number): { value: string; truncated: boolean } {
+  if (Buffer.byteLength(value, "utf8") <= maximum) return { value, truncated: false };
+  const codePoints = [...value];
+  let bytes = 0;
+  let start = codePoints.length;
+  while (start > 0) {
+    const size = Buffer.byteLength(codePoints[start - 1]!, "utf8");
+    if (bytes + size > maximum) break;
+    bytes += size;
+    start -= 1;
+  }
+  return { value: codePoints.slice(start).join(""), truncated: true };
+}
+
+function replaceUnsafeControls(value: string): string {
+  let output = "";
+  for (const codePoint of value) {
+    const code = codePoint.codePointAt(0)!;
+    const safeCharacter = code === 9 || code === 10 || (code >= 32 && code !== 127 && (code < 128 || code > 159) && !/[\p{Cf}\p{Cs}]/u.test(codePoint));
+    output += safeCharacter ? codePoint : "�";
+  }
+  return output;
+}
+
+function safeOutput(raw: Buffer): { output: string; boundedAgain: boolean; sanitized: boolean } {
+  const decoded = raw.toString("utf8");
+  const withoutTerminalSequences = stripVTControlCharacters(decoded);
+  const normalized = replaceUnsafeControls(withoutTerminalSequences.replaceAll(/\r\n?/gu, "\n"));
+  const bounded = utf8Tail(normalized, maxOutputBytes);
+  return { output: bounded.value, boundedAgain: bounded.truncated, sanitized: decoded !== normalized };
+}
+
+function terminateProcessTree(child: ChildProcess, signal: NodeJS.Signals): void {
+  if (process.platform === "win32" && child.pid !== undefined) {
+    const terminator = spawn("taskkill", ["/pid", String(child.pid), "/T", "/F"], { shell: false, stdio: "ignore", windowsHide: true });
+    terminator.once("error", () => child.kill(signal));
+    terminator.once("close", (code) => {
+      if (code !== 0) child.kill(signal);
+    });
+    terminator.unref();
+    return;
+  }
+  if (child.pid !== undefined) {
+    try {
+      process.kill(-child.pid, signal);
+      return;
+    } catch {
+      // Fall back when no detached process group was established.
+    }
+  }
+  child.kill(signal);
+}
+
+function safeSpawnFailure(error: unknown): string {
+  if (error !== null && typeof error === "object") {
+    try {
+      const code = Object.getOwnPropertyDescriptor(error, "code");
+      if (code !== undefined && "value" in code && typeof code.value === "string" && /^[A-Z0-9_]{1,32}$/u.test(code.value)) {
+        return `Could not start npm (${code.value})`;
+      }
+    } catch {
+      // Use the stable fallback below.
+    }
+  }
+  return "Could not start npm";
+}
+
+function cloneRun(run: TestRun): TestRun {
+  return { ...run };
+}
+
+function runNpmScript(cwd: string, script: TestScript, timeoutMs: number, signal: AbortSignal): Promise<TestRun> {
+  throwIfCancelled(signal);
+  const started = Date.now();
+  const command = `npm run ${script}`;
+  const invocation = npmInvocation(script);
+  return new Promise((resolve) => {
+    let child: ChildProcess;
+    try {
+      child = spawn(invocation.executable, invocation.args, {
+        cwd,
+        detached: process.platform !== "win32",
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"],
+        windowsHide: true,
+      });
+    } catch (error) {
+      const output = safeSpawnFailure(error);
+      resolve({
+        script,
+        command,
+        status: "failed",
+        exitCode: null,
+        signal: null,
+        durationMs: Date.now() - started,
+        output,
+        outputBytes: Buffer.byteLength(output, "utf8"),
+        outputTruncated: false,
+        outputSanitized: false,
+      });
+      return;
+    }
+
+    let outputTail: Buffer<ArrayBufferLike> = Buffer.alloc(0);
+    let outputBytes = 0;
+    let outputTruncated = false;
+    let stopReason: "timed-out" | "cancelled" | undefined;
+    let spawnFailure: unknown;
+    let killTimer: ReturnType<typeof setTimeout> | undefined;
+    const append = (chunk: Buffer) => {
+      outputBytes = Math.min(Number.MAX_SAFE_INTEGER, outputBytes + chunk.length);
+      outputTruncated ||= outputBytes > maxOutputBytes;
+      outputTail = appendTail(outputTail, chunk, maxOutputBytes);
+    };
+    const stop = (reason: "timed-out" | "cancelled") => {
+      stopReason ??= reason;
+      if (child.exitCode !== null || child.signalCode !== null) return;
+      terminateProcessTree(child, "SIGTERM");
+      killTimer ??= setTimeout(() => terminateProcessTree(child, "SIGKILL"), terminationGraceMs);
+      killTimer.unref();
+    };
+    const onAbort = () => stop("cancelled");
+    signal.addEventListener("abort", onAbort, { once: true });
+    const timeout = setTimeout(() => stop("timed-out"), timeoutMs);
+    timeout.unref();
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", append);
+    child.once("error", (error) => {
+      spawnFailure = error;
+    });
+    child.once("close", (code, childSignal) => {
+      clearTimeout(timeout);
+      if (killTimer !== undefined && process.platform === "win32") clearTimeout(killTimer);
+      signal.removeEventListener("abort", onAbort);
+      let safe = safeOutput(outputTail);
+      if (spawnFailure !== undefined && safe.output === "") {
+        const output = safeSpawnFailure(spawnFailure);
+        safe = { output, boundedAgain: false, sanitized: false };
+        outputBytes = Buffer.byteLength(output, "utf8");
+      }
+      const status: TestRunStatus = stopReason ?? (code === 0 ? "passed" : "failed");
+      resolve({
+        script,
+        command,
+        status,
+        exitCode: stopReason === undefined ? code : null,
+        signal: childSignal,
+        durationMs: Date.now() - started,
+        output: safe.output,
+        outputBytes,
+        outputTruncated: outputTruncated || safe.boundedAgain,
+        outputSanitized: safe.sanitized,
+      });
+    });
+  });
+}
+
+function agentText(run: TestRun): string {
+  const output = run.output.replace(/<\/test-output(?=\s*>)/giu, "<\\/test-output");
+  return `<test-output command="${run.command}" untrusted="true" status="${run.status}" exit-code="${run.exitCode ?? "unknown"}" output-truncated="${run.outputTruncated}">\n${output}\n</test-output>`;
+}
 
 export default {
   name: "pi-test-harness",
   inject: ["piHarnessLaunch", "piPluginUi", "piTools"],
-  apply(context: Context) {
+  Config,
+  apply(context: Context, config: TestHarnessConfig) {
+    assertKnownConfigKeys("test-harness", config, ["timeoutMs"]);
+    const timeoutMs = config.timeoutMs ?? defaultTimeoutMs;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < minimumTimeoutMs || timeoutMs > maximumTimeoutMs)
+      throw new Error(`Test-harness timeoutMs must be an integer from ${minimumTimeoutMs} through ${maximumTimeoutMs}`);
     let latest: TestRun | undefined;
+    const lifecycle = new AbortController();
+    context.effect(() => () => lifecycle.abort(new Error("Test-harness plugin was disposed")));
     const unregisterTool = context.piTools.register(
       defineTool({
         name: "run_project_tests",
         label: "Run project tests",
-        description: "Run one approved npm script in the current workspace and return its real output.",
+        description: "Run one approved npm verification script in the current workspace with bounded, untrusted output and lifecycle cancellation.",
         promptSnippet: "run an approved project verification script",
-        parameters: Type.Object({ script: Type.Optional(Type.String({ description: "One of test, build, format:check, lint, typecheck" })) }),
-        async execute(_toolCallId, params): Promise<AgentToolResult<TestRun>> {
-          const script = params.script?.trim() || "test";
-          if (!allowedScripts.has(script)) throw new Error(`Script is not allowed: ${script}`);
-          const started = Date.now();
-          try {
-            const result = await execFileAsync("npm", ["run", script], { cwd: context.piHarnessLaunch.cwd, timeout: 120_000, maxBuffer: 4 * 1024 * 1024 });
-            latest = {
-              script,
-              command: `npm run ${script}`,
-              exitCode: 0,
-              durationMs: Date.now() - started,
-              output: `${result.stdout}${result.stderr}`.slice(-12_000),
-            };
-          } catch (error) {
-            const failure = error as { code?: number | string; stdout?: string; stderr?: string; message?: string };
-            latest = {
-              script,
-              command: `npm run ${script}`,
-              exitCode: typeof failure.code === "number" ? failure.code : 1,
-              durationMs: Date.now() - started,
-              output: `${failure.stdout ?? ""}${failure.stderr ?? failure.message ?? ""}`.slice(-12_000),
-            };
-          }
-          const result = latest;
-          return {
-            content: [{ type: "text", text: `${result.command} exited with ${result.exitCode}.\n${result.output}` }],
-            details: result,
-          };
+        parameters: Type.Object(
+          {
+            script: Type.Optional(
+              Type.Union([Type.Literal("test"), Type.Literal("build"), Type.Literal("format:check"), Type.Literal("lint"), Type.Literal("typecheck")], {
+                description: "Approved project verification script; defaults to test",
+              }),
+            ),
+          },
+          { additionalProperties: false },
+        ),
+        executionMode: "sequential",
+        async execute(_toolCallId, rawParams, signal): Promise<AgentToolResult<TestRun>> {
+          const { script } = testHarnessParameters(rawParams);
+          const operationSignal = signal === undefined ? lifecycle.signal : AbortSignal.any([signal, lifecycle.signal]);
+          throwIfCancelled(operationSignal);
+          const run = await runNpmScript(context.piHarnessLaunch.cwd, script, timeoutMs, operationSignal);
+          latest = cloneRun(run);
+          if (run.status === "cancelled") throw new Error("Project verification was cancelled");
+          return { content: [{ type: "text", text: agentText(run) }], details: cloneRun(run) };
         },
       }),
     );
+    context.effect(() => unregisterTool);
     const disposePanel = context.piPluginUi.register({
       id: "test-harness-panel",
       pluginId: "@pi-harness/core/plugins/test-harness",
       title: "Test Harness",
-      description: "执行受限 npm 验证脚本，并显示真实退出码、耗时和输出摘要。",
+      description: "执行受限 npm 验证脚本，并显示真实退出码、耗时和有界输出摘要。",
       icon: "✓",
-      read: () => ({ allowedScripts: [...allowedScripts], latest: latest ?? null }),
-    });
-    context.effect(() => () => {
-      unregisterTool();
-      disposePanel();
+      read: () => ({
+        allowedScripts: [...allowedScripts],
+        latest: latest === undefined ? null : cloneRun(latest),
+        limits: { timeoutMs, outputBytes: maxOutputBytes },
+      }),
     });
+    context.effect(() => disposePanel);
   },
 };

package/packages/core/src/plugins/theme-studio.ts

@@ -125,7 +125,11 @@ export default {
         label: "Set UI theme",
         description: "Select one of the bounded Pi Harness theme presets and persist it in the current session.",
         promptSnippet: "switch the Pi Harness UI theme",
-        parameters: Type.Object({ theme: Type.Union([Type.Literal("light"), Type.Literal("midnight"), Type.Literal("paper"), Type.Literal("high-contrast")]) }),
+        parameters: Type.Object(
+          { theme: Type.Union([Type.Literal("light"), Type.Literal("midnight"), Type.Literal("paper"), Type.Literal("high-contrast")]) },
+          { additionalProperties: false },
+        ),
+        executionMode: "sequential",
         execute(_toolCallId, params): Promise<AgentToolResult<ThemeState>> {
           theme = params.theme;
           changedAt = new Date().toISOString();
@@ -141,7 +145,8 @@ export default {
         label: "Theme status",
         description: "Show the active theme preset and its UI color tokens.",
         promptSnippet: "inspect the active Pi Harness theme",
-        parameters: Type.Object({}),
+        parameters: Type.Object({}, { additionalProperties: false }),
+        executionMode: "sequential",
         execute(): Promise<AgentToolResult<ThemeState>> {
           const details = state();
           return Promise.resolve({ content: [{ type: "text", text: `${details.label}: ${details.description}` }], details });

package/packages/core/src/plugins/token-guard.ts

@@ -1,20 +1,106 @@
 import type { Context } from "@deepseek-ai/cordis";
 import z from "@deepseek-ai/schemastery";
+import { assertKnownConfigKeys } from "../config.js";
 
 export interface TokenGuardPluginConfig {
   maxPercent?: number;
   maxRunTokens?: number;
 }
 
-export const Config: z<TokenGuardPluginConfig> = z.object({ maxPercent: z.number().default(90), maxRunTokens: z.number().default(0) });
+type UsageSnapshot = {
+  percent: number | null;
+  tokens: number | null;
+  contextWindow: number;
+  error: string | null;
+};
+
+type TokenSnapshot = { total: number | null; error: string | null };
+
+const maxErrorLength = 2_000;
+const streamingUpdateInterval = 32;
+const inspectionEventTypes = new Set(["message_end", "turn_end", "tool_execution_end", "agent_end", "agent_settled", "compaction_end", "entry_appended"]);
+
+export const Config: z<TokenGuardPluginConfig> = z.object({
+  maxPercent: z.number().min(1).max(100).default(90),
+  maxRunTokens: z.number().min(0).max(10_000_000).step(1).default(0),
+});
+
+function dataProperty(value: unknown, key: PropertyKey): unknown {
+  if (typeof value !== "object" || value === null) return undefined;
+  try {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor !== undefined && "value" in descriptor ? descriptor.value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function boundedError(prefix: string, error: unknown): string {
+  let message: string | undefined;
+  if (typeof error === "string") message = error;
+  else {
+    const value = dataProperty(error, "message");
+    if (typeof value === "string") message = value;
+  }
+  const suffix = (message ?? "unknown error").replaceAll("\0", "�");
+  return `${prefix}: ${suffix}`.slice(0, maxErrorLength);
+}
+
+function nullableCount(value: unknown): number | null {
+  return value === null || (typeof value === "number" && Number.isSafeInteger(value) && value >= 0) ? value : null;
+}
+
+function readUsage(session: { getContextUsage: () => unknown }): UsageSnapshot {
+  let usage: unknown;
+  try {
+    usage = session.getContextUsage();
+  } catch (error) {
+    return { percent: null, tokens: null, contextWindow: 0, error: boundedError("Context usage inspection failed", error) };
+  }
+  if (usage === undefined) return { percent: null, tokens: null, contextWindow: 0, error: null };
+  const rawPercent = dataProperty(usage, "percent");
+  const rawTokens = dataProperty(usage, "tokens");
+  const tokens = nullableCount(rawTokens);
+  const contextWindow = dataProperty(usage, "contextWindow");
+  if (
+    (rawPercent !== null && (typeof rawPercent !== "number" || !Number.isFinite(rawPercent) || rawPercent < 0)) ||
+    (rawTokens !== null && tokens === null) ||
+    typeof contextWindow !== "number" ||
+    !Number.isSafeInteger(contextWindow) ||
+    contextWindow <= 0
+  ) {
+    return { percent: null, tokens: null, contextWindow: 0, error: "Context usage response is invalid" };
+  }
+  return { percent: rawPercent, tokens, contextWindow, error: null };
+}
+
+function readSessionTokens(session: { getSessionStats?: () => unknown }): TokenSnapshot {
+  if (typeof session.getSessionStats !== "function") return { total: null, error: "Session statistics are unavailable for the configured run-token budget" };
+  let stats: unknown;
+  try {
+    stats = session.getSessionStats();
+  } catch (error) {
+    return { total: null, error: boundedError("Session statistics inspection failed", error) };
+  }
+  const total = dataProperty(dataProperty(stats, "tokens"), "total");
+  return typeof total === "number" && Number.isSafeInteger(total) && total >= 0
+    ? { total, error: null }
+    : { total: null, error: "Session statistics response is invalid" };
+}
+
+function boundedCount(value: number): number {
+  return value >= Number.MAX_SAFE_INTEGER ? Number.MAX_SAFE_INTEGER : value + 1;
+}
 
 export default {
   name: "pi-token-guard",
   inject: ["piRuntime", "piPluginUi"],
   Config,
   apply(context: Context, config: TokenGuardPluginConfig) {
-    const maxPercent = Math.max(1, Math.min(100, config.maxPercent ?? 90));
-    const maxRunTokens = Math.max(0, Math.min(10_000_000, Math.trunc(config.maxRunTokens ?? 0)));
+    assertKnownConfigKeys("pi-token-guard", config, ["maxPercent", "maxRunTokens"]);
+    const maxPercent = config.maxPercent ?? 90;
+    const maxRunTokens = config.maxRunTokens ?? 0;
+    let activeSession: unknown;
     let abortCount = 0;
     let lastPercent: number | null = null;
     let lastTokens: number | null = null;
@@ -24,37 +110,92 @@ export default {
     let runStartTokens: number | null = null;
     let runTokens: number | null = null;
     let runExceeded = false;
-    const sessionTokens = (): number | null => {
-      const stats = context.piRuntime.session.getSessionStats?.();
-      const total = stats?.tokens?.total;
-      return typeof total === "number" && Number.isFinite(total) && total >= 0 ? total : null;
+    let inspectionError: string | null = null;
+    let abortError: string | null = null;
+    let messageUpdatesSinceInspection = 0;
+    let sampledCurrentStream = false;
+
+    const resetForSession = (session: unknown): void => {
+      activeSession = session;
+      abortCount = 0;
+      lastPercent = null;
+      lastTokens = null;
+      lastContextWindow = 0;
+      lastExceeded = false;
+      abortIssued = false;
+      runStartTokens = null;
+      runTokens = null;
+      runExceeded = false;
+      inspectionError = null;
+      abortError = null;
+      messageUpdatesSinceInspection = 0;
+      sampledCurrentStream = false;
     };
-    const inspect = (): void => {
-      const usage = context.piRuntime.session.getContextUsage();
-      lastPercent = usage?.percent ?? null;
-      lastTokens = usage?.tokens ?? null;
-      lastContextWindow = usage?.contextWindow ?? 0;
-      lastExceeded = lastPercent !== null && lastPercent >= maxPercent;
-      const currentTokens = sessionTokens();
-      runTokens = runStartTokens === null || currentTokens === null ? null : Math.max(0, currentTokens - runStartTokens);
-      runExceeded = maxRunTokens > 0 && runTokens !== null && runTokens >= maxRunTokens;
-      lastExceeded = lastExceeded || runExceeded;
-      if (!lastExceeded) abortIssued = false;
-      if (lastExceeded && context.piRuntime.session.isStreaming && !abortIssued) {
-        abortIssued = true;
-        abortCount += 1;
-        void context.piRuntime.abort();
+    const requestAbort = (): void => {
+      abortIssued = true;
+      abortCount = boundedCount(abortCount);
+      abortError = null;
+      try {
+        void context.piRuntime.abort().catch((error: unknown) => {
+          abortError = boundedError("Token Guard could not abort the active run", error);
+        });
+      } catch (error) {
+        abortError = boundedError("Token Guard could not abort the active run", error);
       }
     };
-    const unsubscribe = context.on("pi/session-event", (event) => {
-      if (event.type === "agent_start") {
-        runStartTokens = sessionTokens();
+    const inspect = (eventType?: string): void => {
+      const session = context.piRuntime.session;
+      if (session !== activeSession) resetForSession(session);
+      const usage = readUsage(session);
+      const sessionTokens = maxRunTokens > 0 ? readSessionTokens(session) : { total: null, error: null };
+      inspectionError = usage.error ?? sessionTokens.error;
+      lastPercent = usage.percent;
+      lastTokens = usage.tokens;
+      lastContextWindow = usage.contextWindow;
+      if (eventType === "agent_start") {
+        runStartTokens = sessionTokens.total;
         runTokens = runStartTokens === null ? null : 0;
         runExceeded = false;
         abortIssued = false;
+        abortError = null;
+      } else {
+        runTokens = runStartTokens === null || sessionTokens.total === null ? null : Math.max(0, sessionTokens.total - runStartTokens);
+        runExceeded = maxRunTokens > 0 && runTokens !== null && runTokens >= maxRunTokens;
+      }
+      lastExceeded = (lastPercent !== null && lastPercent >= maxPercent) || runExceeded;
+      if (lastExceeded && session.isStreaming && !abortIssued) requestAbort();
+    };
+
+    resetForSession(context.piRuntime.session);
+    inspect();
+    const unsubscribe = context.on("pi/session-event", (event) => {
+      const type = dataProperty(event, "type");
+      if (type === "agent_start") {
+        messageUpdatesSinceInspection = 0;
+        sampledCurrentStream = false;
+        inspect(type);
+        return;
+      }
+      if (type === "message_update") {
+        if (!sampledCurrentStream) {
+          sampledCurrentStream = true;
+          inspect();
+          return;
+        }
+        messageUpdatesSinceInspection += 1;
+        if (messageUpdatesSinceInspection >= streamingUpdateInterval) {
+          inspect();
+          messageUpdatesSinceInspection = 0;
+        }
+        return;
+      }
+      if (typeof type === "string" && inspectionEventTypes.has(type)) {
+        messageUpdatesSinceInspection = 0;
+        sampledCurrentStream = false;
+        inspect();
       }
-      inspect();
     });
+    context.effect(() => unsubscribe);
     const disposePanel = context.piPluginUi.register({
       id: "token-guard-panel",
       pluginId: "@pi-harness/core/plugins/token-guard",
@@ -62,7 +203,7 @@ export default {
       description: "在上下文达到预算阈值时自动停止当前运行，避免继续消耗上下文。",
       icon: "◌",
       read: () => {
-        inspect();
+        if (context.piRuntime.session !== activeSession) inspect();
         return {
           maxPercent,
           maxRunTokens,
@@ -73,12 +214,11 @@ export default {
           runExceeded,
           exceeded: lastExceeded,
           aborts: abortCount,
+          lastError: abortError ?? inspectionError,
+          limits: { errorCharacters: maxErrorLength, streamingUpdateInterval },
         };
       },
     });
-    context.effect(() => () => {
-      unsubscribe();
-      disposePanel();
-    });
+    context.effect(() => disposePanel);
   },
 };

package/packages/core/src/plugins/tools.ts

@@ -8,9 +8,12 @@ export interface ToolsPluginConfig {
 }
 
 const DEFAULT_TOOLS = ["read", "bash", "edit", "write"];
+const maxToolNames = 256;
+const maxToolNameLength = 128;
+const toolNamePattern = /^[^\s\p{Cc}]+$/u;
 
 export const Config: z<ToolsPluginConfig> = z.object({
-  names: z.array(z.string().min(1)).default(DEFAULT_TOOLS),
+  names: z.array(z.string().min(1).max(maxToolNameLength).pattern(toolNamePattern)).max(maxToolNames).default(DEFAULT_TOOLS),
 });
 
 export default {