@pi-harness/pi-harness 0.1.13 → 0.1.15

package/packages/core/src/plugins/auto-mode.ts

@@ -1,123 +0,0 @@
-import { execFile } from "node:child_process";
-import { promisify } from "node:util";
-import type { Context } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
-
-const execFileAsync = promisify(execFile);
-const maxArgs = 32;
-const maxArgBytes = 4096;
-const maxOutputBytes = 128 * 1024;
-const defaultTimeoutMs = 30_000;
-const shellWrappers = new Set(["sh", "bash", "zsh", "fish", "cmd", "powershell", "pwsh"]);
-const riskyCommands = new Set(["rm", "rmdir", "del", "sudo", "su", "chmod", "chown", "kill", "pkill", "dd", "mkfs"]);
-const riskyWords = new Set(["reset", "clean", "push", "publish", "curl", "wget", "ssh", "scp"]);
-type AutoModeResult = { command: string[]; allowed: boolean; confirmed: boolean; exitCode: number | null; stdout: string; stderr: string; durationMs: number };
-
-export interface AutoModePluginConfig {
-  mode?: "safe" | "confirm";
-  timeoutMs?: number;
-}
-export const Config: z<AutoModePluginConfig> = z.object({
-  mode: z.union(["safe", "confirm"]).default("safe"),
-  timeoutMs: z.number().default(defaultTimeoutMs),
-});
-
-function validateCommand(command: string[]): void {
-  if (command.length === 0 || command.length > maxArgs) throw new Error(`Auto mode command must contain between 1 and ${maxArgs} arguments`);
-  if (command.some((part) => part.length === 0 || Buffer.byteLength(part, "utf8") > maxArgBytes))
-    throw new Error("Auto mode command contains an invalid argument");
-  if (shellWrappers.has((command[0] ?? "").split("/").at(-1)!.toLowerCase()))
-    throw new Error("Auto mode rejects shell wrappers; pass an executable argv directly");
-}
-
-function isRisky(command: string[]): boolean {
-  const executable = (command[0] ?? "").split("/").at(-1)!.toLowerCase();
-  return riskyCommands.has(executable) || command.slice(1).some((part) => riskyWords.has(part.toLowerCase()));
-}
-
-export default {
-  name: "pi-auto-mode",
-  inject: ["piHarnessLaunch", "piPluginUi", "piTools"],
-  Config,
-  apply(context: Context, config: AutoModePluginConfig) {
-    const mode = config.mode === "confirm" ? "confirm" : "safe";
-    const timeoutMs = Math.max(1_000, Math.min(120_000, Math.trunc(config.timeoutMs ?? defaultTimeoutMs)));
-    let blocked = 0;
-    let last: AutoModeResult | undefined;
-    const execute = async (command: string[], confirm: boolean): Promise<AutoModeResult> => {
-      try {
-        validateCommand(command);
-      } catch (error) {
-        blocked += 1;
-        throw error;
-      }
-      const risky = isRisky(command);
-      if (risky && !confirm) {
-        blocked += 1;
-        throw new Error("Auto mode blocked a risky command; retry with confirm=true");
-      }
-      if (mode === "confirm" && !confirm) {
-        blocked += 1;
-        throw new Error("Auto mode is configured for confirmation; retry with confirm=true");
-      }
-      const started = Date.now();
-      try {
-        const result = await execFileAsync(command[0]!, command.slice(1), { cwd: context.piHarnessLaunch.cwd, timeout: timeoutMs, maxBuffer: maxOutputBytes });
-        last = {
-          command: [...command],
-          allowed: true,
-          confirmed: confirm,
-          exitCode: 0,
-          stdout: result.stdout.slice(-maxOutputBytes),
-          stderr: result.stderr.slice(-maxOutputBytes),
-          durationMs: Date.now() - started,
-        };
-      } catch (error) {
-        const failure = error as { code?: number | string; stdout?: string; stderr?: string; message?: string };
-        last = {
-          command: [...command],
-          allowed: true,
-          confirmed: confirm,
-          exitCode: typeof failure.code === "number" ? failure.code : 1,
-          stdout: (failure.stdout ?? "").slice(-maxOutputBytes),
-          stderr: (failure.stderr ?? failure.message ?? "").slice(-maxOutputBytes),
-          durationMs: Date.now() - started,
-        };
-      }
-      return last;
-    };
-    const unregisterTool = context.piTools.register(
-      defineTool({
-        name: "auto_mode_exec",
-        label: "Auto mode exec",
-        description: "Execute an argv command under the configured safe/confirmation policy without a shell.",
-        promptSnippet: "run a command through the safe auto-mode policy",
-        parameters: Type.Object({
-          command: Type.Array(Type.String()),
-          confirm: Type.Optional(Type.Boolean({ description: "Confirm a risky or confirmation-mode command" })),
-        }),
-        async execute(_toolCallId, params): Promise<AgentToolResult<AutoModeResult>> {
-          const result = await execute(params.command, params.confirm === true);
-          return {
-            content: [{ type: "text", text: `${result.command.join(" ")} exited with ${result.exitCode ?? "unknown"}.\n${result.stdout}${result.stderr}` }],
-            details: result,
-          };
-        },
-      }),
-    );
-    const disposePanel = context.piPluginUi.register({
-      id: "auto-mode-panel",
-      pluginId: "@pi-harness/core/plugins/auto-mode",
-      title: "Auto Mode",
-      description: "按安全策略执行 argv 命令，风险操作需要确认。",
-      icon: "◈",
-      read: () => ({ mode, timeoutMs, blocked, last: last ?? null }),
-    });
-    context.effect(() => () => {
-      unregisterTool();
-      disposePanel();
-    });
-  },
-};

package/packages/core/src/plugins/better-sidebar.ts

@@ -1,117 +0,0 @@
-import type { Context } from "@deepseek-ai/cordis";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
-import { listWorkspaceNodes, readWorkspaceGitStatus, type WorkspaceGitStatus, type WorkspaceNodeReport } from "./workspace-navigator.js";
-
-export interface SidebarOverviewInput {
-  readonly cwd: string;
-  readonly gitAvailable: boolean;
-  readonly branch: string | null;
-  readonly clean: boolean;
-  readonly changedFiles: readonly { readonly path: string; readonly status: string }[];
-  readonly directoryCount: number;
-  readonly fileCount: number;
-  readonly truncated: boolean;
-  readonly sessionId: string;
-}
-
-export interface SidebarOverview extends SidebarOverviewInput {
-  readonly changedCount: number;
-  readonly summary: string;
-}
-
-export function summarizeSidebar(input: SidebarOverviewInput): SidebarOverview {
-  const changedCount = input.changedFiles.length;
-  const summary = !input.gitAvailable
-    ? `非 Git 工作区 · ${changedCount > 0 ? `${changedCount} 个变更` : "无变更"}`
-    : `${input.branch ?? "detached HEAD"} · ${changedCount > 0 ? `${changedCount} 个变更` : "clean"}`;
-  return { ...input, changedFiles: input.changedFiles.slice(0, 12), changedCount, summary };
-}
-
-export function createSidebarInspector(input: {
-  readonly cwd: string;
-  readonly getSessionId: () => string;
-  readonly listNodes?: (root: string, options: { maxDepth: number; maxNodes: number }) => Promise<WorkspaceNodeReport>;
-  readonly readGitStatus?: (root: string) => Promise<WorkspaceGitStatus>;
-}): () => Promise<SidebarOverview> {
-  const readNodes = input.listNodes ?? listWorkspaceNodes;
-  const readGit = input.readGitStatus ?? readWorkspaceGitStatus;
-  let tree: WorkspaceNodeReport | undefined;
-  let inFlight: Promise<SidebarOverview> | undefined;
-
-  const inspect = async (): Promise<SidebarOverview> => {
-    const [currentTree, git] = await Promise.all([
-      tree === undefined
-        ? readNodes(input.cwd, { maxDepth: 2, maxNodes: 80 }).then((result) => {
-            tree = result;
-            return result;
-          })
-        : Promise.resolve(tree),
-      readGit(input.cwd),
-    ]);
-    return summarizeSidebar({
-      cwd: input.cwd,
-      gitAvailable: git.available,
-      branch: git.available ? git.branch : null,
-      clean: git.available && git.clean,
-      changedFiles: git.entries,
-      directoryCount: currentTree.directoryCount,
-      fileCount: currentTree.fileCount,
-      truncated: currentTree.truncated,
-      sessionId: input.getSessionId(),
-    });
-  };
-
-  return () => {
-    if (inFlight !== undefined) return inFlight;
-    const current = inspect().finally(() => {
-      if (inFlight === current) inFlight = undefined;
-    });
-    inFlight = current;
-    return current;
-  };
-}
-
-function textSummary(report: SidebarOverview): string {
-  const files = report.changedFiles
-    .slice(0, 8)
-    .map((entry) => `${entry.status} ${entry.path}`)
-    .join(", ");
-  return `${report.summary}; ${report.directoryCount} 个目录，${report.fileCount} 个文件${files ? `; ${files}` : ""}`;
-}
-
-export default {
-  name: "pi-better-sidebar",
-  inject: ["piHarnessLaunch", "piSession", "piPluginUi", "piTools"],
-  apply(context: Context) {
-    const inspect = createSidebarInspector({
-      cwd: context.piHarnessLaunch.cwd,
-      getSessionId: () => context.piSession.manager.getSessionId(),
-    });
-    const unregisterTool = context.piTools.register(
-      defineTool({
-        name: "sidebar_overview",
-        label: "Sidebar overview",
-        description: "Read a compact workspace and Git overview for the current session without modifying files.",
-        promptSnippet: "inspect the workspace overview shown in the sidebar",
-        parameters: Type.Object({}),
-        async execute(): Promise<AgentToolResult<SidebarOverview>> {
-          const report = await inspect();
-          return { content: [{ type: "text", text: textSummary(report) }], details: report };
-        },
-      }),
-    );
-    const disposePanel = context.piPluginUi.register({
-      id: "better-sidebar-panel",
-      pluginId: "@pi-harness/core/plugins/better-sidebar",
-      title: "Better Sidebar",
-      description: "在会话旁显示当前工作区、Git 变更和文件概览。",
-      icon: "▤",
-      read: inspect,
-    });
-    context.effect(() => () => {
-      unregisterTool();
-      disposePanel();
-    });
-  },
-};

package/packages/core/src/plugins/browser-fetch.ts

@@ -1,171 +0,0 @@
-import { lookup } from "node:dns/promises";
-import { isIP } from "node:net";
-import type { Context } from "@deepseek-ai/cordis";
-import z from "@deepseek-ai/schemastery";
-import { Type } from "@earendil-works/pi-ai";
-import { defineTool, type AgentToolResult } from "@earendil-works/pi-coding-agent";
-
-const maxResponseBytes = 512 * 1024;
-const maxRedirects = 3;
-const requestTimeoutMs = 20_000;
-
-type BrowserFetchResult = { url: string; finalUrl: string; status: number; contentType: string; bytes: number; truncated: boolean; text: string };
-
-function privateIpv4(address: string): boolean {
-  const octets = address.split(".").map(Number);
-  if (octets.length !== 4 || octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) return true;
-  const first = octets[0] ?? -1;
-  const second = octets[1] ?? -1;
-  return (
-    first === 0 ||
-    first === 10 ||
-    first === 127 ||
-    (first === 100 && second >= 64 && second <= 127) ||
-    (first === 169 && second === 254) ||
-    (first === 172 && second >= 16 && second <= 31) ||
-    (first === 192 && second === 0) ||
-    (first === 192 && second === 168) ||
-    (first === 198 && (second === 18 || second === 19)) ||
-    first >= 224
-  );
-}
-
-function privateIp(address: string): boolean {
-  if (isIP(address) === 4) return privateIpv4(address);
-  const normalized = address.toLowerCase();
-  return (
-    normalized === "::1" ||
-    normalized.startsWith("fc") ||
-    normalized.startsWith("fd") ||
-    normalized.startsWith("fe8") ||
-    normalized.startsWith("fe9") ||
-    normalized.startsWith("fea") ||
-    normalized.startsWith("feb") ||
-    normalized.startsWith("::ffff:10.") ||
-    normalized.startsWith("::ffff:192.168.") ||
-    normalized.startsWith("::ffff:127.")
-  );
-}
-
-async function validateTarget(rawUrl: string, allowPrivate: boolean): Promise<URL> {
-  if (rawUrl.length === 0 || rawUrl.length > 4096) throw new Error("Browser URL must be between 1 and 4096 characters");
-  let url: URL;
-  try {
-    url = new URL(rawUrl);
-  } catch {
-    throw new Error("Browser URL is invalid");
-  }
-  if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("Browser fetch only supports http and https URLs");
-  if (url.username !== "" || url.password !== "") throw new Error("Browser URL must not contain credentials");
-  if (!allowPrivate) {
-    const addresses = await lookup(url.hostname, { all: true, verbatim: true });
-    if (addresses.some(({ address }) => privateIp(address))) throw new Error("Browser fetch blocked a private or local network target");
-  }
-  return url;
-}
-
-async function readBody(response: Response): Promise<{ bytes: number; truncated: boolean; text: string }> {
-  if (response.body === null) return { bytes: 0, truncated: false, text: "" };
-  const reader = response.body.getReader();
-  const chunks: Uint8Array[] = [];
-  let bytes = 0;
-  let truncated = false;
-  try {
-    while (true) {
-      const next = await reader.read();
-      if (next.done) break;
-      const chunk = next.value;
-      if (bytes + chunk.byteLength > maxResponseBytes) {
-        const remaining = maxResponseBytes - bytes;
-        if (remaining > 0) chunks.push(chunk.subarray(0, remaining));
-        bytes = maxResponseBytes;
-        truncated = true;
-        await reader.cancel();
-        break;
-      }
-      chunks.push(chunk);
-      bytes += chunk.byteLength;
-    }
-  } finally {
-    reader.releaseLock();
-  }
-  return { bytes, truncated, text: Buffer.concat(chunks.map((chunk) => Buffer.from(chunk))).toString("utf8") };
-}
-
-async function fetchPage(rawUrl: string, allowPrivate: boolean): Promise<BrowserFetchResult> {
-  let current = await validateTarget(rawUrl, allowPrivate);
-  const original = current.toString();
-  for (let redirect = 0; redirect <= maxRedirects; redirect += 1) {
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), requestTimeoutMs);
-    let response: Response;
-    try {
-      response = await fetch(current, {
-        redirect: "manual",
-        signal: controller.signal,
-        headers: { accept: "text/html, text/plain, application/json;q=0.9, */*;q=0.1", "user-agent": "pi-harness-browser-fetch/0.1" },
-      });
-    } catch (error) {
-      if (error instanceof Error && error.name === "AbortError") throw new Error("Browser fetch timed out after 20 seconds", { cause: error });
-      throw error;
-    } finally {
-      clearTimeout(timer);
-    }
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get("location");
-      if (location === null) throw new Error(`Browser redirect ${response.status} has no Location header`);
-      if (redirect === maxRedirects) throw new Error(`Browser fetch exceeded the ${maxRedirects}-redirect limit`);
-      current = await validateTarget(new URL(location, current).toString(), allowPrivate);
-      continue;
-    }
-    const body = await readBody(response);
-    return {
-      url: original,
-      finalUrl: current.toString(),
-      status: response.status,
-      contentType: (response.headers.get("content-type") ?? "text/plain").split(";", 1)[0]!.trim(),
-      ...body,
-    };
-  }
-  throw new Error("Browser fetch did not produce a response");
-}
-
-export interface BrowserFetchPluginConfig {
-  allowPrivate?: boolean;
-}
-
-export const Config: z<BrowserFetchPluginConfig> = z.object({ allowPrivate: z.boolean().default(false) });
-
-export default {
-  name: "pi-browser-fetch",
-  inject: ["piHarnessLaunch", "piPluginUi", "piTools"],
-  Config,
-  apply(context: Context, config: BrowserFetchPluginConfig) {
-    let latest: BrowserFetchResult | undefined;
-    const unregisterTool = context.piTools.register(
-      defineTool({
-        name: "browser_fetch",
-        label: "Browser fetch",
-        description: "Fetch a public HTTP or HTTPS page as bounded text without executing page scripts.",
-        promptSnippet: "fetch a public web page for inspection",
-        parameters: Type.Object({ url: Type.String({ description: "HTTP or HTTPS URL" }) }),
-        async execute(_toolCallId, params): Promise<AgentToolResult<BrowserFetchResult>> {
-          latest = await fetchPage(params.url, config.allowPrivate === true);
-          return { content: [{ type: "text", text: latest.text }], details: latest };
-        },
-      }),
-    );
-    const disposePanel = context.piPluginUi.register({
-      id: "browser-fetch-panel",
-      pluginId: "@pi-harness/core/plugins/browser-fetch",
-      title: "Browser Fetch",
-      description: "受限抓取公开网页文本，不执行页面脚本。",
-      icon: "◎",
-      read: () => ({ latest: latest ?? null, allowPrivate: config.allowPrivate === true, maxResponseBytes }),
-    });
-    context.effect(() => () => {
-      unregisterTool();
-      disposePanel();
-    });
-  },
-};