@signalridge/pi-welcome 1.3.4 → 1.3.5

package/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 1.3.5
+### Patch Changes
+
+- c1b1741: Durability and containment fixes found in a repository-wide scan.
+  
+  `pi-gpt-fast` rewrote pi's own global `settings.json` with a plain
+  `writeFileSync`. That file is shared with pi and every other extension, and this
+  one is the only writer of it; a torn write would have left the user with no pi
+  configuration at all rather than just no gpt-fast setting. It now writes a temp
+  file and renames, matching every other settings writer in the repository.
+  `pi-goal` gets the same treatment for its cross-project goal state file, which
+  its own settings module already did.
+  
+  `pi-ralph-wiggum` resolved `/ralph start <path>` straight against the session
+  cwd, so `../../notes.md` would create directories and a file outside the project
+  the user opened — silently, before the loop started. This extension drives long
+  unattended loops, so that command is as likely to come from a model as from a
+  person. Task-file paths are now required to stay inside the workspace, on the
+  command, on the `ralph_start` tool, and on the paths read back out of persisted
+  state, so a state file written earlier or edited by hand cannot pull a file in
+  from outside either.
+  
+  The containment test canonicalizes both sides before comparing, because a purely
+  lexical one is defeated by a symlink: every segment of `linked/plan.md` reads as
+  inside the workspace when `linked` is a door out of it. `realpathSync` throws on
+  a path that does not exist yet — the ordinary case, since `start` is usually
+  creating the file — so it resolves the deepest existing ancestor and re-attaches
+  the not-yet-created suffix, which cannot itself be a link. The traversal test
+  matches a `..` segment rather than a `..` prefix; the prefix form also rejected
+  `..notes.md`, an ordinary filename sitting in the workspace.
+  
+  Every remaining bare `catch {}` now says why the error is safe to drop, matching
+  the convention the rest of the repository already follows.
+
 ## 1.3.4
 ### Patch Changes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-welcome",
-  "version": "1.3.4",
+  "version": "1.3.5",
   "description": "Startup resource and repository summary card for Pi.",
   "type": "module",
   "license": "MIT",

package/src/index.ts

@@ -221,14 +221,19 @@ function collectExtensionNames(cwd: string): string[] {
         const bare = (spec.startsWith("@") ? (spec.split("/")[1] ?? spec) : basename(spec)).replace(/@.*$/u, "");
         names.push(bare.replace(/^pi-/u, ""));
       }
-    } catch {}
+    } catch {
+      // Discovery is best-effort: a malformed manifest contributes no names
+      // rather than blanking the whole card.
+    }
   }
   for (const directory of [join(getAgentDir(), "extensions"), join(cwd, ".pi", "extensions")]) {
     try {
       for (const entry of readdirSync(directory)) {
         names.push(entry.replace(/\.[cm]?[jt]s$/u, "").replace(/^pi-/u, ""));
       }
-    } catch {}
+    } catch {
+      // An extensions directory that does not exist is the normal case.
+    }
   }
   return tidy(names);
 }
@@ -271,7 +276,9 @@ export function collectResources(pi: ExtensionAPI, cwd: string): [string, string
     // Several scopes can contribute the same filename (a project AGENTS.md and
     // a global one); the card names kinds of context, not paths.
     push("Context", nameList(tidy(files.map((file) => basename(file.path)))));
-  } catch {}
+  } catch {
+    // One unreadable source drops its row; the card still renders the rest.
+  }
 
   try {
     const commands = pi.getCommands?.() ?? [];
@@ -279,7 +286,9 @@ export function collectResources(pi: ExtensionAPI, cwd: string): [string, string
       tidy(commands.filter((command) => command.source === source).map((command) => `${prefix}${command.name}`));
     push("Skills", nameList(named("skill")));
     push("Prompts", nameList(named("prompt", "/")));
-  } catch {}
+  } catch {
+    // A host without these accessors simply contributes no rows.
+  }
 
   push("Extensions", nameList(collectExtensionNames(cwd)));
   push("Themes", nameList(collectThemeNames()));
@@ -288,7 +297,9 @@ export function collectResources(pi: ExtensionAPI, cwd: string): [string, string
     const all = pi.getAllTools?.() ?? [];
     const active = pi.getActiveTools?.() ?? [];
     if (all.length) push("Tools", `${active.length} active of ${all.length}`);
-  } catch {}
+  } catch {
+    // A host without these accessors simply contributes no rows.
+  }
 
   return rows;
 }
@@ -501,7 +512,10 @@ export default function (pi: ExtensionAPI) {
           return;
         }
       }
-    } catch {}
+    } catch {
+      // Unreadable entries mean we cannot prove the card was already written.
+      // Falling through re-appends it, which beats never showing it at all.
+    }
 
     try {
       pi.appendEntry<WelcomeData>(ENTRY_TYPE, collect(pi, ctx));