@piagent/platform 1.44.4 → 1.45.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/platform",
-  "version": "1.44.4",
+  "version": "1.45.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public",

package/packages/piagent-core/extensions/working-tree-snapshot-worker.mjs

@@ -0,0 +1,9 @@
+import { parentPort, workerData } from 'node:worker_threads';
+import { matchesProtectedPath } from './policy-core.js';
+import { workingTreeSnapshot } from './task-state.js';
+// Hash the working tree away from the thread that draws the terminal.
+const { cwd, gitTimeoutMs, protectedPaths } = workerData;
+parentPort.postMessage(workingTreeSnapshot(cwd, {
+  gitTimeoutMs,
+  isProtectedProjectPath: (projectPath) => Boolean(matchesProtectedPath(projectPath, protectedPaths))
+}));

package/packages/piagent-core/extensions/workspace-evidence-roots.js

@@ -104,11 +104,17 @@ function directChildGitEvidenceRootDetails(cwd) {
         complete = false;
         continue;
       }
-      if (!isGitWorkingTree(child)) {
+      // One Git process per child: a parent of thirty repositories ran sixty.
+      let inside, topLevel;
+      try {
+        [inside, topLevel] = gitOutput(child, ["rev-parse", "--is-inside-work-tree", "--show-toplevel"]).trim().split("\n");
+      } catch {
+        inside = "false";
+      }
+      if (inside !== "true" || !topLevel) {
         complete = false;
         continue;
       }
-      const topLevel = gitOutput(child, ["rev-parse", "--show-toplevel"]).trim();
       if (fs.realpathSync(topLevel) !== fs.realpathSync(child)) {
         complete = false;
         continue;
@@ -143,6 +149,26 @@ export function gitEvidenceRoots(cwd) {
   return gitEvidenceRootDetails(cwd).roots;
 }
 
+// Whether the working tree differs from HEAD, without reading any file: the
+// same answer as a non-empty workingTreeSnapshot, which hashes every changed
+// and loose file and blocked the terminal for seconds on each prompt in a
+// folder of repositories. Unknown counts as changed, as it does there.
+export function workingTreeHasChanges(cwd, details = gitEvidenceRootDetails(cwd)) {
+  if (!details.complete) return true;
+  for (const root of details.roots) {
+    try {
+      const status = gitOutput(root.cwd, ["status", "--porcelain", "-z", "--untracked-files=normal",
+        "--", ".", ":(exclude).pi/piagent-state"]);
+      if (status) return true;
+    } catch {
+      return true;
+    }
+  }
+  if (details.roots.length === 0 || details.roots.some((root) => root.prefix === "")) return false;
+  const loose = nonGitWorkspaceFileDetails(cwd, details.roots.map((root) => root.prefix), 1);
+  return loose.files.length > 0 || !loose.complete;
+}
+
 function workspaceEvidenceFileLimit(value) {
   return Number.isInteger(value)
     ? Math.max(1, Math.min(WORKSPACE_EVIDENCE_MAX_FILES, value))

package/packages/piagent-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@piagent/core",
-  "version": "1.44.4",
+  "version": "1.45.0",
   "type": "module",
   "private": true,
   "license": "MIT",

package/packages/piagent-core/runtime/hooks/input-hook.ts

@@ -1,3 +1,5 @@
+import path from "node:path";
+
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 
 import { classifyContextTask } from "../../extensions/context-engine.js";
@@ -5,6 +7,7 @@ import { matchesProtectedPath } from "../../extensions/policy-core.js";
 import type { TaskContract } from "../../extensions/guard-types.js";
 import { attachLocalImagesFromText, extractLocalImagePathCandidates } from "../input/chat-images.ts";
 import type { ChatImageAccessPolicy } from "../input/chat-images.ts";
+import { reviewFileArguments } from "../input/file-arguments.ts";
 import type { AuthorityResumeDecision } from "../policy/authority-resume-policy.ts";
 import { registerAdaptiveContextGovernor } from "../session/adaptive-context-governor.ts";
 import { toolGroupsForPrompt, PIAGENT_TOOL_NAMES, PIAGENT_TOOL_ORDER, PIAGENT_TOOL_GROUPS } from "../tools/tool-groups.ts";
@@ -74,10 +77,21 @@ export function registerInputHook(pi: ExtensionAPI, dependencies: InputHookDepen
       .filter((group) => !["intake", "task", "recovery"].includes(group)));
     dependencies.telemetry(ctx, { event: "user_input", turnId: turn.turnId, source: event.source,
       promptHash: signal.promptHash, promptChars: text.length, inputMode: "freeform" });
-    const attachment = attachLocalImagesFromText(text, event.images, ctx.cwd, () => dependencies.imageAccess(ctx));
+    const reviewed = reviewFileArguments(text, event.images, ctx.cwd, () => dependencies.imageAccess(ctx));
+    if (reviewed && !reviewed.text) {
+      ctx.ui.notify("Not sent: a file changed while Pi was reading the @file arguments. Run the command again.", "error");
+      return { action: "handled" };
+    }
+    if (reviewed) ctx.ui.notify(`Withheld ${reviewed.withheld.map((item) => `${path.basename(item.path)} (${item.reason})`).join(", ")}`, "warning");
+    const nextText = reviewed?.text ?? text;
+    const nextImages = reviewed ? reviewed.images as typeof event.images : event.images;
+    const attachment = attachLocalImagesFromText(nextText, nextImages, ctx.cwd, () => dependencies.imageAccess(ctx));
+    if (attachment?.skipped.length) {
+      ctx.ui.notify(`Skipped ${attachment.skipped.map((item) => `${path.basename(item.path)} (${item.reason})`).join(", ")}`, "warning");
+    }
     if (attachment?.attached.length) return { action: "transform", text: attachment.text,
-      images: [...(event.images ?? []), ...attachment.images] };
-    if (attachment?.skipped.length) ctx.ui.notify(`Skipped ${attachment.skipped.length} inaccessible image(s)`, "warning");
+      images: [...(nextImages ?? []), ...attachment.images] };
+    if (reviewed) return { action: "transform", text: nextText, images: nextImages };
     return { action: "continue" };
   });
 }

package/packages/piagent-core/runtime/input/chat-images.ts

@@ -29,6 +29,25 @@ type ResolvedChatImage =
   | { status: "ok"; absolutePath: string; bytes: Buffer; mimeType: string }
   | { status: "error"; reason: string };
 
+export type ChatPathAccess =
+  | { status: "ok"; canonicalPath: string; stats: fs.Stats }
+  | { status: "error"; reason: string };
+
+// Pi saves a pasted clipboard image as <tmpdir>/pi-clipboard-<uuid>.<ext> and
+// inserts that path into the prompt. The operator created it by pasting, so it
+// counts as granted even though the temporary directory is not.
+const PI_CLIPBOARD_IMAGE = /^pi-clipboard-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\.(?:png|jpe?g|gif|webp|bmp)$/i;
+
+function clipboardImageRoot(canonicalPath: string): { path: string; source: string } | undefined {
+  if (!PI_CLIPBOARD_IMAGE.test(path.basename(canonicalPath))) return undefined;
+  try {
+    const temporary = fs.realpathSync.native(os.tmpdir());
+    return path.dirname(canonicalPath) === temporary ? { path: temporary, source: "clipboard" } : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function escapeRegExp(input: string): string {
   return input.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -108,12 +127,31 @@ function normalizeImagePathCandidate(candidate: string, cwd: string, options: {
   }
   const ext = path.extname(raw).toLowerCase().replace(/^\./, "");
   if (!IMAGE_EXTENSIONS.includes(ext as typeof IMAGE_EXTENSIONS[number])) return undefined;
-  return path.isAbsolute(raw) ? raw : path.resolve(cwd, raw);
+  const resolved = path.isAbsolute(raw) ? raw : path.resolve(cwd, raw);
+  // A file dropped on a terminal arrives shell-escaped: "Screenshot\ 1.png".
+  if (!WINDOWS && /\\[ ()'&]/.test(resolved) && !fs.existsSync(resolved)) {
+    const unescaped = resolved.replace(/\\([ ()'&])/g, "$1");
+    if (fs.existsSync(unescaped)) return unescaped;
+  }
+  return resolved;
 }
 
-export function extractLocalImagePathCandidates(text: string, cwd: string): string[] {
+// Pi's own @file arguments arrive as <file name="..."> blocks with their images
+// already attached; scanning them again would attach each image twice.
+const FILE_ARGUMENT_TAG = /<file name="[^"\n]*">/g;
+
+export function extractLocalImagePathCandidates(input: string, cwd: string): string[] {
+  const text = input.replace(FILE_ARGUMENT_TAG, "");
   const candidates = new Set<string>();
   const imageExt = "(?:png|jpe?g|gif|webp|bmp)";
+
+  // Pi's @ completion inserts @path, or @"path" when the path has spaces.
+  const mention = new RegExp(`(?:^|\\s)@(?:"([^"\\n]+\\.${imageExt})"|([^\\s"'<>@]+\\.${imageExt}))(?=$|[\\s,;:!?)])`, "gi");
+  for (const match of text.matchAll(mention)) {
+    const normalized = normalizeImagePathCandidate(match[1] ?? match[2], cwd);
+    if (normalized) candidates.add(normalized);
+  }
+
   const wholeTextPath = normalizeImagePathCandidate(text, cwd, { allowBareRelative: false });
   if (wholeTextPath) candidates.add(wholeTextPath);
 
@@ -149,11 +187,12 @@ function pathContainedBy(root: string, candidate: string): boolean {
     && !path.isAbsolute(relative);
 }
 
-export function readChatImage(
+/** Whether the operator's policy lets a chat message carry this file at all. */
+export function checkChatPathAccess(
   requestedPath: string,
   cwd: string,
   access: ChatImageAccessPolicy
-): ResolvedChatImage {
+): ChatPathAccess {
   const lexicalRequestedPath = path.isAbsolute(requestedPath)
     ? path.normalize(requestedPath)
     : path.resolve(cwd, requestedPath);
@@ -170,17 +209,16 @@ export function readChatImage(
     return { status: "error", reason: "file does not exist or cannot be inspected" };
   }
   if (!inspected.isFile()) return { status: "error", reason: "not a regular file" };
-  if (inspected.size <= 0) return { status: "error", reason: "empty file" };
-  if (inspected.size > MAX_CHAT_IMAGE_BYTES) {
+
+  const root = access.roots.find((candidate) => pathContainedBy(candidate.path, canonicalPath))
+    ?? clipboardImageRoot(canonicalPath);
+  if (!root) {
     return {
       status: "error",
-      reason: `image is ${formatCount(inspected.size)} bytes > ${formatCount(MAX_CHAT_IMAGE_BYTES)} byte limit`
+      reason: "outside the project; grant its folder with profile additionalReadRoots or PIAGENT_ADDITIONAL_READ_ROOTS"
     };
   }
 
-  const root = access.roots.find((candidate) => pathContainedBy(candidate.path, canonicalPath));
-  if (!root) return { status: "error", reason: "outside the project and every granted additionalReadRoots directory" };
-
   const rootRelative = path.relative(root.path, canonicalPath).split(path.sep).join("/") || ".";
   const projectRoot = access.roots.find((candidate) => candidate.source === "project");
   let canonicalRequestedLocation = requestedPath;
@@ -216,6 +254,24 @@ export function readChatImage(
       reason: `outside the resolved filesystem read scope (${access.filesystemRead.join(", ")})`
     };
   }
+  return { status: "ok", canonicalPath, stats: inspected };
+}
+
+export function readChatImage(
+  requestedPath: string,
+  cwd: string,
+  access: ChatImageAccessPolicy
+): ResolvedChatImage {
+  const checked = checkChatPathAccess(requestedPath, cwd, access);
+  if (checked.status === "error") return checked;
+  const { canonicalPath, stats: inspected } = checked;
+  if (inspected.size <= 0) return { status: "error", reason: "empty file" };
+  if (inspected.size > MAX_CHAT_IMAGE_BYTES) {
+    return {
+      status: "error",
+      reason: `image is ${formatCount(inspected.size)} bytes > ${formatCount(MAX_CHAT_IMAGE_BYTES)} byte limit`
+    };
+  }
 
   access.onImageInspected?.(canonicalPath);
   const openFlags = fs.constants.O_RDONLY | fs.constants.O_NONBLOCK | fs.constants.O_NOFOLLOW;

package/packages/piagent-core/runtime/input/file-arguments.ts

@@ -0,0 +1,102 @@
+import fs from "node:fs";
+import path from "node:path";
+
+import { checkChatPathAccess, supportedChatImageMimeType } from "./chat-images.ts";
+import type { ChatImageAccessPolicy } from "./chat-images.ts";
+
+// `pi @notes.md @screen.png "…"` reads each file before any extension runs and
+// sends it as one <file name="/abs/path">…</file> block per argument, images
+// attached in argument order. Pi applies no read policy, so `pi @.env` would
+// hand a secret to the model. This holds those blocks to the same rule as a
+// pasted image path: inside a granted root, not protected, within read scope.
+
+export type FileArgumentReview = {
+  text: string;
+  images: unknown[];
+  withheld: Array<{ path: string; reason: string }>;
+};
+
+type FileBlock = { path: string; start: number; end: number; image: boolean; attachesImage: boolean };
+
+const BLOCK_OPEN = /<file name="([^"\n]+)">/g;
+
+function stripBom(text: string): string {
+  return text.charCodeAt(0) === 0xfeff ? text.slice(1) : text;
+}
+
+// Walk the contiguous run of blocks Pi wrote. Each block's end is found from
+// the file itself, so a file whose text contains "</file>" cannot end it early.
+// undefined: a block no longer matches its file, and the run cannot be trusted.
+function parseFileBlocks(text: string): FileBlock[] | undefined {
+  BLOCK_OPEN.lastIndex = 0;
+  const first = BLOCK_OPEN.exec(text);
+  if (!first) return [];
+  const blocks: FileBlock[] = [];
+  let cursor = first.index;
+  while (text.startsWith("<file name=\"", cursor)) {
+    BLOCK_OPEN.lastIndex = cursor;
+    const open = BLOCK_OPEN.exec(text);
+    if (!open || open.index !== cursor || !path.isAbsolute(open[1])) break;
+    const filePath = open[1];
+    const bodyStart = cursor + open[0].length;
+    let bytes: Buffer;
+    try { bytes = fs.readFileSync(filePath); } catch { return undefined; }
+    if (supportedChatImageMimeType(bytes) || !text.startsWith("\n", bodyStart)) {
+      // An image block holds nothing, or a one-line note from Pi.
+      const close = text.indexOf("</file>\n", bodyStart);
+      if (close < 0) return undefined;
+      const note = text.slice(bodyStart, close);
+      blocks.push({ path: filePath, start: cursor, end: close + 8, image: true,
+        attachesImage: !note.startsWith("[Image omitted") });
+      cursor = close + 8;
+      continue;
+    }
+    const expected = `\n${stripBom(bytes.toString("utf8"))}\n</file>\n`;
+    if (!text.startsWith(expected, bodyStart)) return undefined;
+    blocks.push({ path: filePath, start: cursor, end: bodyStart + expected.length, image: false, attachesImage: false });
+    cursor = bodyStart + expected.length;
+  }
+  return blocks;
+}
+
+/** Withhold Pi @file blocks the read policy does not allow; undefined when there is nothing to change. */
+export function reviewFileArguments(
+  text: string,
+  existingImages: unknown[] | undefined,
+  cwd: string,
+  resolveAccess: () => ChatImageAccessPolicy
+): FileArgumentReview | undefined {
+  if (!text.includes("<file name=\"")) return undefined;
+  const images = Array.isArray(existingImages) ? existingImages : [];
+  const blocks = parseFileBlocks(text);
+  if (blocks === undefined) {
+    return { text: "", images: [], withheld: [{ path: "(@file arguments)", reason: "a file changed while Pi was reading it" }] };
+  }
+  if (blocks.length === 0) return undefined;
+  const access = resolveAccess();
+  const withheld: FileArgumentReview["withheld"] = [];
+  const droppedImages = new Set<number>();
+  const imageBlocks = blocks.filter((block) => block.attachesImage);
+  // Pi attaches only its file images to the first message; any other count
+  // means the order cannot be matched, so a withheld image drops them all.
+  const imagesMatch = imageBlocks.length === images.length;
+  let nextText = "";
+  let cursor = 0;
+  for (const block of blocks) {
+    const checked = checkChatPathAccess(block.path, cwd, access);
+    if (checked.status === "ok") continue;
+    withheld.push({ path: block.path, reason: checked.reason });
+    nextText += text.slice(cursor, block.start)
+      + `<file name="${block.path}">[Withheld by Piagent: ${checked.reason}]</file>\n`;
+    cursor = block.end;
+    if (!block.attachesImage) continue;
+    if (!imagesMatch) images.forEach((_, index) => droppedImages.add(index));
+    else droppedImages.add(imageBlocks.indexOf(block));
+  }
+  if (withheld.length === 0) return undefined;
+  return {
+    text: nextText + text.slice(cursor),
+    images: images.filter((_, index) => !droppedImages.has(index)),
+    withheld
+  };
+}

package/packages/piagent-core/runtime/inspection/webui-snapshot.ts

@@ -3,7 +3,7 @@ import { createHash } from "node:crypto";
 import type { TaskContract } from "../../extensions/guard-types.ts";
 import { matchesProtectedPath } from "../../extensions/policy-core.js";
 import { redactSensitiveText } from "../../extensions/redaction-core.js";
-import { workingTreeSnapshot } from "../../extensions/task-state.js";
+import { workingTreeSnapshotOffThread } from "./working-tree-off-thread.ts";
 import { workingTreeEvidenceDigest, workingTreeSnapshotUsesCurrentAlgorithm } from "../../extensions/working-tree-digest.js";
 import { inspectTaskContinuationBudget } from "../recovery/continuation-budget.ts";
 import { handoffIdentityMatchesTask, readHandoffProjection } from "../recovery/handoff-projection.ts";
@@ -365,11 +365,7 @@ export async function buildWebUiInspectionProjection(input: {
   const identity: WebUiIdentity = { projectRef: webUiProjectRef(input.cwd), runtimeInstanceId: input.runtimeInstanceId ?? WEBUI_RUNTIME_INSTANCE_REF,
     sessionRef: webUiSessionRef(input.sessionId), taskId: input.task?.taskId ?? null, taskRunId: input.task?.taskRunId ?? null, agentOperationId: null, toolCallId: null };
   const effectiveProtectedPaths = input.protectedPaths ?? input.task?.protectedPaths ?? [];
-  // Synchronous: the Gateway answers nobody while it runs (task-state.js).
-  const currentSnapshot = workingTreeSnapshot(input.cwd, {
-    gitTimeoutMs: 8_000,
-    isProtectedProjectPath: (projectPath: string) => Boolean(matchesProtectedPath(projectPath, effectiveProtectedPaths))
-  }) as Record<string, string>;
+  const currentSnapshot = await workingTreeSnapshotOffThread(input.cwd, { gitTimeoutMs: 8_000, protectedPaths: effectiveProtectedPaths });
   const taskRevision = input.task ? webUiTaskRevision(input.task) : null;
   const views = await collectSourceChangeViews({ cwd: input.cwd, identity, generatedAt, taskRevision,
     isProtectedPath: (_root, repoPath) => Boolean(matchesProtectedPath(repoPath, effectiveProtectedPaths)) });

package/packages/piagent-core/runtime/inspection/working-tree-off-thread.ts

@@ -0,0 +1,52 @@
+import { Worker } from "node:worker_threads";
+
+import { matchesProtectedPath } from "../../extensions/policy-core.js";
+import { workingTreeSnapshot } from "../../extensions/task-state.js";
+
+type Snapshot = Record<string, string>;
+type Options = { gitTimeoutMs: number; protectedPaths: string[] };
+
+// The inspection hashes every changed and loose file. On the main thread that
+// froze the terminal for seconds after each answer in a folder of
+// repositories, twice (turn end, then agent settled). A worker keeps the
+// terminal drawing; refreshes that overlap share one scan.
+const inFlight = new Map<string, Promise<Snapshot>>();
+
+function inline(cwd: string, options: Options): Snapshot {
+  return workingTreeSnapshot(cwd, {
+    gitTimeoutMs: options.gitTimeoutMs,
+    isProtectedProjectPath: (projectPath: string) => Boolean(matchesProtectedPath(projectPath, options.protectedPaths))
+  }) as Snapshot;
+}
+
+function scan(cwd: string, options: Options): Promise<Snapshot> {
+  return new Promise((resolve, reject) => {
+    let worker: Worker;
+    try {
+      worker = new Worker(new URL("../../extensions/working-tree-snapshot-worker.mjs", import.meta.url),
+        { workerData: { cwd, ...options } });
+    } catch {
+      resolve(inline(cwd, options));
+      return;
+    }
+    let settled = false;
+    const fallback = () => {
+      if (settled) return; settled = true;
+      try { resolve(inline(cwd, options)); } catch (error) { reject(error); }
+    };
+    worker.once("message", (snapshot: Snapshot) => {
+      if (settled) return; settled = true; resolve(snapshot); void worker.terminate();
+    });
+    worker.once("error", fallback);
+    worker.once("exit", fallback);
+  });
+}
+
+export function workingTreeSnapshotOffThread(cwd: string, options: Options): Promise<Snapshot> {
+  const key = JSON.stringify([cwd, options.gitTimeoutMs, options.protectedPaths]);
+  const running = inFlight.get(key);
+  if (running) return running;
+  const started = scan(cwd, options).finally(() => inFlight.delete(key));
+  inFlight.set(key, started);
+  return started;
+}

package/packages/piagent-core/runtime/solver/runtime-features.ts

@@ -1,6 +1,6 @@
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
-import { hasGitEvidenceRoot, workingTreeSnapshot } from "../../extensions/task-state.js";
+import { gitEvidenceRootDetails, workingTreeHasChanges } from "../../extensions/workspace-evidence-roots.js";
 import type { ProjectProfile, TaskContract } from "../../extensions/guard-types.ts";
 import type { RuntimeModelSnapshot } from "../model/runtime-snapshot.ts";
 import { runtimeModelSnapshotDigest } from "../model/runtime-snapshot.ts";
@@ -8,6 +8,19 @@ import type { TaskFeatureInput } from "./task-features.ts";
 import type { SolverShadowEvaluation } from "./solver-shadow.ts";
 import { SolverShadowRuntime } from "./solver-shadow.ts";
 
+// Finding the repositories under a parent folder runs Git once per child and
+// blocks the terminal; they rarely change between two prompts.
+const ROOTS_TTL_MS = 30_000;
+const rootDetails = new Map<string, { at: number; details: ReturnType<typeof gitEvidenceRootDetails> }>();
+function gitShape(cwd: string): { gitReady: boolean; dirtyTree: boolean } {
+  let cached = rootDetails.get(cwd);
+  if (!cached || Date.now() - cached.at > ROOTS_TTL_MS) {
+    try { cached = { at: Date.now(), details: gitEvidenceRootDetails(cwd) }; } catch { return { gitReady: false, dirtyTree: true }; }
+    rootDetails.set(cwd, cached);
+  }
+  return { gitReady: cached.details.roots.length > 0, dirtyTree: workingTreeHasChanges(cwd, cached.details) };
+}
+
 export function runtimeTaskFeatureInput(options: {
   request: string;
   ctx: ExtensionContext;
@@ -29,8 +42,7 @@ export function runtimeTaskFeatureInput(options: {
     request,
     profileMode: profile.mode ?? null,
     projectShape: roles,
-    gitReady: hasGitEvidenceRoot(ctx.cwd),
-    dirtyTree: Object.keys(workingTreeSnapshot(ctx.cwd) as Record<string, string>).length > 0,
+    ...gitShape(ctx.cwd),
     verifierReady: profileVerifier || taskVerifier,
     contextPressure,
     activeTaskState: !activeTask ? "none" : activeTask.trace.outcome === "pending" ? "pending" : "terminal",