@signalridge/pi-worktree 1.4.6 → 1.5.0

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 1.5.0
+### Minor Changes
+
+- 3096585: Qualify the shared TUI Kit 0.69 release against Pi 1.5, synchronizing all consumer ranges. Forward native viewport capture through border adapters and declare it for custom selectors so configured paging reaches the focused list while overlays retain priority.
+  
+  Settle bordered custom interactions locally on dispose-only host teardown without invoking a stale host completion callback. Preserve consumer-owned cancellation, session fences, draft handling, and accepted-work draining; dispose wrapped components exactly once.
+
+### Patch Changes
+
+- 3096585: Bound combined Git and PR subprocess output by operation, reject incomplete safety data, preserve uncertain mutation outcomes for inspection, and let passive statusline timers release the process naturally.
+- 3096585: Move the development SDK pins to exact Pi 1.5.0 while retaining wildcard host-owned peers and canonical TypeBox 1.3.27. Import the advisor's schema builder directly from TypeBox and report the required `truncated` flag from local Git process adapters. Update SDK fixtures for the new baseline and pi-schema validation diagnostics without changing lifecycle, consent, or model-selection policy.
+- Updated dependencies [3096585]
+- Updated dependencies [3096585]
+  - @signalridge/pi-ui@1.5.0
+
 ## 1.4.6
 ### Patch Changes
 

package/README.md

@@ -170,6 +170,10 @@ packages/pi-worktree/
 └── tsconfig.json
 ```
 
+## Local divergence
+
+This fork retains the guarded inventory, quarantine, metadata-pruning, and process-ownership safeguards described above. Git capture budgets count combined stdout/stderr bytes per operation: metadata 64 KiB, inventories 8 MiB, and mutations 1 MiB. Incomplete output is rejected before parsing or expected-nonzero fallback, including sparse-checkout rule checks. An incomplete inventory never authorizes deletion. Mutation overflow may occur after Git commits its change: inspect `git worktree list` and affected paths before retrying; the extension does not automatically roll back that uncertain outcome. Stdin capture handles fragmented UTF-8 and uses the same bounded TERM/KILL/drain ownership on overflow as on cancellation and timeout.
+
 ## License
 
 MIT

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalridge/pi-worktree",
-  "version": "1.4.6",
+  "version": "1.5.0",
   "description": "Pi extension for safe interactive Git worktree management and workspace switching.",
   "type": "module",
   "license": "MIT",
@@ -39,8 +39,8 @@
   },
   "devDependencies": {
     "@biomejs/biome": "2.5.7",
-    "@earendil-works/pi-coding-agent": "1.4.0",
-    "@earendil-works/pi-tui": "1.4.0",
+    "@earendil-works/pi-coding-agent": "1.5.0",
+    "@earendil-works/pi-tui": "1.5.0",
     "@types/node": "26.1.2",
     "@types/proper-lockfile": "^4.1.4",
     "typescript": "7.0.2",
@@ -59,8 +59,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@narumitw/pi-tui-kit": "^0.54.0",
-    "@signalridge/pi-ui": "^1.4.1",
+    "@narumitw/pi-tui-kit": "^0.69.0",
+    "@signalridge/pi-ui": "^1.5.0",
     "proper-lockfile": "^4.1.2"
   }
 }

package/src/git-input.ts

@@ -1,4 +1,5 @@
 import { type ChildProcessWithoutNullStreams, spawn } from "node:child_process";
+import { StringDecoder } from "node:string_decoder";
 import type { ExecResult } from "@earendil-works/pi-coding-agent";
 
 // An unconfirmed process remains owned by its actual handle. Never signal a
@@ -6,6 +7,7 @@ import type { ExecResult } from "@earendil-works/pi-coding-agent";
 const unconfirmed = new Map<string, Set<ChildProcessWithoutNullStreams>>();
 const TERM_GRACE_MS = 250;
 const CONFIRMATION_MS = 1_000;
+const INVENTORY_MAX_BYTES = 8 * 1024 * 1024;
 
 type SignalAttempt = { signal: NodeJS.Signals; accepted: boolean; error?: Error };
 
@@ -16,6 +18,7 @@ export class GitInputError extends Error {
   readonly reason: string;
   readonly terminationConfirmed: boolean;
   readonly signals: readonly SignalAttempt[];
+  readonly truncated: boolean;
 
   constructor(
     message: string,
@@ -25,6 +28,7 @@ export class GitInputError extends Error {
     terminationConfirmed: boolean,
     signals: readonly SignalAttempt[],
     cause?: Error,
+    truncated = false,
   ) {
     super(message, { cause });
     this.name = "GitInputError";
@@ -33,6 +37,7 @@ export class GitInputError extends Error {
     this.reason = reason;
     this.terminationConfirmed = terminationConfirmed;
     this.signals = [...signals];
+    this.truncated = truncated;
   }
 }
 
@@ -60,7 +65,11 @@ export function runGitInput(
   input: string,
   signal?: AbortSignal,
   timeout = 15_000,
+  maxBuffer = INVENTORY_MAX_BYTES,
 ): Promise<ExecResult> {
+  if (!Number.isSafeInteger(maxBuffer) || maxBuffer < 0) {
+    return Promise.reject(new RangeError("maxBuffer must be a nonnegative safe integer"));
+  }
   const key = JSON.stringify([cwd, args]);
   const previous = unconfirmed.get(key);
   if (previous) {
@@ -73,18 +82,22 @@ export function runGitInput(
     }
     unconfirmed.delete(key);
   }
-  if (signal?.aborted) return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true });
+  if (signal?.aborted) return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true, truncated: false });
   return new Promise((resolve, reject) => {
     const child = spawn("git", args, { cwd, stdio: ["pipe", "pipe", "pipe"], windowsHide: true });
     let stdout = "";
     let stderr = "";
+    let capturedBytes = 0;
+    let truncated = false;
+    const stdoutDecoder = new StringDecoder("utf8");
+    const stderrDecoder = new StringDecoder("utf8");
     let settled = false;
     let stopping = false;
     let reason = "";
     let failure: Error | undefined;
     const signals: SignalAttempt[] = [];
     const capturedFailure = (message: string, confirmed: boolean, cause?: Error) =>
-      new GitInputError(message, stdout, stderr, reason, confirmed, signals, cause);
+      new GitInputError(message, stdout, stderr, reason, confirmed, signals, cause, truncated);
     let escalation: ReturnType<typeof setTimeout> | undefined;
     let confirmation: ReturnType<typeof setTimeout> | undefined;
     const cleanup = () => {
@@ -151,21 +164,43 @@ export function runGitInput(
     const inputError = (value: NodeJS.ErrnoException) => {
       if (value.code !== "EPIPE") error(value);
     };
-    const output = (chunk: string) => {
-      stdout += chunk;
+    // Count raw bytes across BOTH pipes, including fragmented UTF-8 code points.
+    // Once full, keep draining without retaining output until the owned child closes.
+    const capture = (chunk: Buffer, decoder: StringDecoder): string => {
+      if (truncated) return "";
+      const retained = chunk.subarray(0, Math.max(0, maxBuffer - capturedBytes));
+      capturedBytes += retained.length;
+      const text = decoder.write(retained);
+      if (retained.length < chunk.length) {
+        truncated = true;
+        stop(`output overflow (${maxBuffer} bytes)`);
+      }
+      return text;
+    };
+    const output = (chunk: Buffer) => {
+      stdout += capture(chunk, stdoutDecoder);
     };
-    const diagnostics = (chunk: string) => {
-      stderr += chunk;
+    const diagnostics = (chunk: Buffer) => {
+      stderr += capture(chunk, stderrDecoder);
     };
     const close = (code: number | null, closeSignal: NodeJS.Signals | null) => {
+      // Do not synthesize a replacement character for a code point cut by the cap.
+      if (!truncated) {
+        stdout += stdoutDecoder.end();
+        stderr += stderrDecoder.end();
+      }
       finish(
-        { stdout, stderr, code: code ?? 1, killed: stopping || closeSignal !== null },
+        {
+          stdout,
+          stderr,
+          code: truncated ? code || 1 : (code ?? 1),
+          killed: stopping || closeSignal !== null,
+          truncated,
+        },
         failure ? capturedFailure(failure.message, true, failure) : undefined,
       );
     };
     const deadline = setTimeout(() => stop(`${timeout}ms timeout`), timeout);
-    child.stdout.setEncoding("utf8");
-    child.stderr.setEncoding("utf8");
     child.stdout.on("data", output);
     child.stderr.on("data", diagnostics);
     child.stdin.on("error", inputError);

package/src/git.ts

@@ -2,12 +2,16 @@ import { randomUUID } from "node:crypto";
 import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync } from "node:fs";
 import { lstat, readdir, rename, rmdir, unlink } from "node:fs/promises";
 import { basename, dirname, join, resolve } from "node:path";
-import type { ExecResult, ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import type { ExecOptions, ExecResult, ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import lockfile from "proper-lockfile";
 import { GitInputError, runGitInput } from "./git-input.ts";
 
 const GIT_TIMEOUT_MS = 15_000;
 const GIT_MUTATION_TIMEOUT_MS = 60_000;
+// Operation classes, not user settings: incomplete safety inventories must fail closed.
+const GIT_METADATA_MAX_BYTES = 64 * 1024;
+const GIT_INVENTORY_MAX_BYTES = 8 * 1024 * 1024;
+const GIT_MUTATION_MAX_BYTES = 1024 * 1024;
 const MUTATION_LOCK_WAIT_MS = 50;
 const MUTATION_LOCK_TIMEOUT_MS = 120_000;
 const MUTATION_LOCK_STALE_MS = 30_000;
@@ -55,11 +59,7 @@ export interface GitClient {
   exec(command: string, args: string[], options?: GitExecOptions): Promise<ExecResult>;
 }
 
-interface GitExecOptions {
-  cwd?: string;
-  signal?: AbortSignal;
-  timeout?: number;
-}
+type GitExecOptions = ExecOptions;
 
 export class GitWorktreeError extends Error {
   readonly args?: readonly string[];
@@ -242,7 +242,14 @@ export async function listWorktrees(
   cwd: string,
   signal?: AbortSignal,
 ): Promise<WorktreeRecord[]> {
-  const result = await runGit(pi, ["worktree", "list", "--porcelain", "-z"], cwd, signal);
+  const result = await runGit(
+    pi,
+    ["worktree", "list", "--porcelain", "-z"],
+    cwd,
+    signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
+  );
   return parseWorktreePorcelain(result.stdout);
 }
 
@@ -313,7 +320,7 @@ export async function addWorktree(
   input: AddArguments,
   signal?: AbortSignal,
 ): Promise<void> {
-  await runGit(pi, buildAddArguments(input), cwd, signal, GIT_MUTATION_TIMEOUT_MS);
+  await runGitMutation(pi, buildAddArguments(input), cwd, signal);
 }
 
 export async function moveWorktree(
@@ -323,7 +330,7 @@ export async function moveWorktree(
   newPath: string,
   signal?: AbortSignal,
 ): Promise<void> {
-  await runGit(pi, ["worktree", "move", path, newPath], cwd, signal, GIT_MUTATION_TIMEOUT_MS);
+  await runGitMutation(pi, ["worktree", "move", path, newPath], cwd, signal);
 }
 
 export async function removeWorktree(
@@ -332,7 +339,7 @@ export async function removeWorktree(
   path: string,
   signal?: AbortSignal,
 ): Promise<void> {
-  await runGit(pi, ["worktree", "remove", path], cwd, signal, GIT_MUTATION_TIMEOUT_MS);
+  await runGitMutation(pi, ["worktree", "remove", path], cwd, signal);
 }
 
 async function waitForMutationLock(signal?: AbortSignal): Promise<void> {
@@ -541,6 +548,7 @@ export async function removeWorktreeMetadata(
       cwd,
       signal,
       GIT_MUTATION_TIMEOUT_MS,
+      GIT_INVENTORY_MAX_BYTES,
     );
     const previewEntries = prunePreviewEntries(`${preview.stdout}\n${preview.stderr}`);
     if (
@@ -554,7 +562,7 @@ export async function removeWorktreeMetadata(
     } else {
       signal?.throwIfAborted();
       try {
-        await runGit(pi, ["worktree", "prune", "--expire", "now"], cwd, signal, GIT_MUTATION_TIMEOUT_MS);
+        await runGitMutation(pi, ["worktree", "prune", "--expire", "now"], cwd, signal);
       } catch (error) {
         // An interrupted Git process may already have deregistered the tree.
         throw new WorktreeRecoveryError(
@@ -597,10 +605,17 @@ export async function worktreeInventory(
     "--ignored=matching",
     "--ignore-submodules=none",
   ];
-  const status = await runGit(pi, statusArgs, path, signal);
-  const indexFlags = await runGit(pi, ["ls-files", "-v", "-z"], path, signal);
+  const status = await runGit(pi, statusArgs, path, signal, GIT_TIMEOUT_MS, GIT_INVENTORY_MAX_BYTES);
+  const indexFlags = await runGit(pi, ["ls-files", "-v", "-z"], path, signal, GIT_TIMEOUT_MS, GIT_INVENTORY_MAX_BYTES);
   const indexInventory = await indexFlagInventory(pi, indexFlags.stdout, path, signal);
-  const submoduleStatus = await runGit(pi, ["submodule", "status", "--recursive"], path, signal);
+  const submoduleStatus = await runGit(
+    pi,
+    ["submodule", "status", "--recursive"],
+    path,
+    signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
+  );
   const initializedSubmodules = nonEmptyLines(submoduleStatus.stdout)
     .filter((line) => !line.startsWith("-"))
     .map((line) => `initialized submodule: ${line.slice(1).trimStart()}`);
@@ -615,6 +630,8 @@ export async function worktreeInventory(
     ],
     path,
     signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
   );
   return [
     ...nonEmptyLines(status.stdout),
@@ -646,7 +663,14 @@ export async function worktreeStatusOutput(
   //
   // `-z` so a path containing a newline or a quote is read exactly as git wrote
   // it, rather than through the quoting v1 output would need.
-  const result = await runGit(pi, ["status", "--porcelain=v2", "--untracked-files=all", "-z"], path, signal);
+  const result = await runGit(
+    pi,
+    ["status", "--porcelain=v2", "--untracked-files=all", "-z"],
+    path,
+    signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
+  );
   return result.stdout;
 }
 
@@ -675,9 +699,18 @@ export async function administrativeHistoryOids(
     [gitDirArgument, "for-each-ref", "--format=%(objectname)", "refs/worktree", "refs/rewritten", "refs/bisect"],
     cwd,
     signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
   );
   values.push(...splitAdministrativeOids(refs.stdout, "per-worktree refs"));
-  const reflogs = await runGit(pi, [gitDirArgument, "reflog", "--all", "--format=%H"], cwd, signal);
+  const reflogs = await runGit(
+    pi,
+    [gitDirArgument, "reflog", "--all", "--format=%H"],
+    cwd,
+    signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
+  );
   values.push(...splitAdministrativeOids(reflogs.stdout, "Git reflogs"));
 
   for (const name of ["ORIG_HEAD", "MERGE_HEAD", "REBASE_HEAD", "CHERRY_PICK_HEAD", "REVERT_HEAD", "BISECT_HEAD"]) {
@@ -988,12 +1021,21 @@ export async function durableRefsContaining(
     ["for-each-ref", "--format=%(refname)", `--contains=${head}`, "refs/heads", "refs/tags", "refs/remotes"],
     cwd,
     signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
   );
   return nonEmptyLines(result.stdout);
 }
 
 export async function prunePreview(pi: Pick<ExtensionAPI, "exec">, cwd: string, signal?: AbortSignal): Promise<string> {
-  const result = await runGit(pi, ["worktree", "prune", "--dry-run", "--verbose"], cwd, signal);
+  const result = await runGit(
+    pi,
+    ["worktree", "prune", "--dry-run", "--verbose"],
+    cwd,
+    signal,
+    GIT_TIMEOUT_MS,
+    GIT_INVENTORY_MAX_BYTES,
+  );
   return combineOutput(result);
 }
 
@@ -1021,7 +1063,7 @@ export async function pruneWorktrees(
       if (approvedCandidates?.length || hasAdministrativeWorktrees(cwd) || existsSync(worktreeMutationLockKey(cwd))) {
         throw new GitWorktreeError("No approved Git administrative records are available to prune.");
       }
-      const result = await runGit(pi, ["worktree", "prune", "--verbose"], cwd, signal, GIT_MUTATION_TIMEOUT_MS);
+      const result = await runGitMutation(pi, ["worktree", "prune", "--verbose"], cwd, signal);
       return combineOutput(result);
     }
     for (const candidate of candidates) await removeAdministrativeRecord(candidate, signal);
@@ -1100,8 +1142,9 @@ async function runGit(
   cwd: string,
   signal?: AbortSignal,
   timeout = GIT_TIMEOUT_MS,
+  maxBuffer = GIT_METADATA_MAX_BYTES,
 ): Promise<ExecResult> {
-  const result = await runGitAllowFailure(pi, args, cwd, signal, timeout);
+  const result = await runGitAllowFailure(pi, args, cwd, signal, timeout, maxBuffer);
   if (result.killed) throw killedError(args);
   if (result.code !== 0) throw gitFailure(args, result);
   return result;
@@ -1113,13 +1156,25 @@ async function runGitAllowFailure(
   cwd: string,
   signal?: AbortSignal,
   timeout = GIT_TIMEOUT_MS,
+  maxBuffer = GIT_METADATA_MAX_BYTES,
+  mutation = false,
 ): Promise<ExecResult> {
   try {
     signal?.throwIfAborted();
-    const result = await pi.exec("git", args, { cwd, signal, timeout });
+    const result = await pi.exec("git", args, { cwd, signal, timeout, maxBuffer });
+    // Check before cancellation/nonzero handling: overflow is not an expected Git failure.
+    if (result.truncated) {
+      if (mutation) {
+        throw new WorktreeRecoveryError(
+          `git ${args.slice(0, 2).join(" ")} output exceeded ${maxBuffer} bytes; mutation outcome may already be committed. Inspect git worktree list and affected paths before retrying; do not automatically roll back.`,
+        );
+      }
+      throw outputLimitError(args, maxBuffer);
+    }
     signal?.throwIfAborted();
     return result;
   } catch (error) {
+    if (error instanceof GitWorktreeError) throw error;
     const message = formatError(error);
     if (/\bENOENT\b|not found/i.test(message)) {
       throw new GitWorktreeError("Git executable was not found. Install Git and retry.", args);
@@ -1128,6 +1183,27 @@ async function runGitAllowFailure(
   }
 }
 
+function outputLimitError(args: string[], maxBuffer: number): GitWorktreeError {
+  return new GitWorktreeError(
+    `git ${args.slice(0, 2).join(" ")} output exceeded ${maxBuffer} bytes; result is incomplete.`,
+    args,
+  );
+}
+
+async function runGitMutation(
+  pi: Pick<ExtensionAPI, "exec">,
+  args: string[],
+  cwd: string,
+  signal?: AbortSignal,
+): Promise<ExecResult> {
+  // Unlike read-only overflow, a noisy mutation may already have committed.
+  // Never authorize automatic rollback from its incomplete diagnostics.
+  const result = await runGitAllowFailure(pi, args, cwd, signal, GIT_MUTATION_TIMEOUT_MS, GIT_MUTATION_MAX_BYTES, true);
+  if (result.killed) throw killedError(args);
+  if (result.code !== 0) throw gitFailure(args, result);
+  return result;
+}
+
 function gitFailure(args: string[], result: ExecResult): GitWorktreeError {
   const detail = stripTerminalControls([result.stderr.trim(), result.stdout.trim()].filter(Boolean).join("\n"));
   const hint = /not a git repository/i.test(detail)
@@ -1225,16 +1301,22 @@ function runGitWithInputAllowFailure(
   timeout = GIT_TIMEOUT_MS,
 ): Promise<ExecResult> {
   if (signal?.aborted) {
-    return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true });
+    return Promise.resolve({ stdout: "", stderr: "", code: 1, killed: true, truncated: false });
   }
   // ExtensionAPI.exec has no stdin channel. This local argv-only owner bounds
   // both cancellation and timeout cleanup without changing native Git settings.
-  return runGitInput(args, cwd, input, signal, timeout).catch((error: unknown) => {
-    const message = formatError(error);
-    throw /\bENOENT\b|not found/i.test(message)
-      ? new GitWorktreeError("Git executable was not found. Install Git and retry.", args, error)
-      : new GitWorktreeError(`git ${args.slice(0, 2).join(" ")}: ${message}`, args, error);
-  });
+  return runGitInput(args, cwd, input, signal, timeout, GIT_INVENTORY_MAX_BYTES)
+    .then((result) => {
+      if (result.truncated) throw outputLimitError(args, GIT_INVENTORY_MAX_BYTES);
+      return result;
+    })
+    .catch((error: unknown) => {
+      if (error instanceof GitWorktreeError) throw error;
+      const message = formatError(error);
+      throw /\bENOENT\b|not found/i.test(message)
+        ? new GitWorktreeError("Git executable was not found. Install Git and retry.", args, error)
+        : new GitWorktreeError(`git ${args.slice(0, 2).join(" ")}: ${message}`, args, error);
+    });
 }
 
 function nulSeparatedPaths(value: string, source: string): string[] {

package/src/safe-remove.ts

@@ -323,7 +323,11 @@ export async function removeWorktreeSafely(
         signal?.throwIfAborted();
         await removeSnapshot(tombstonePath, snapshot, beforeDeleteEntry);
       } catch (error: unknown) {
-        if (!tombstonePath && !metadataRemoved) {
+        if (!tombstonePath && !metadataRemoved && error instanceof WorktreeRecoveryError) {
+          // Mutation output overflow cannot prove whether Git committed the move.
+          // Filesystem presence alone cannot authorize another mutation as rollback.
+          moveOutcomeUnknown = true;
+        } else if (!tombstonePath && !metadataRemoved) {
           try {
             const outcome = await classifyMoveOutcome(path, quarantinePath);
             if (outcome === "moved") moved = true;