@spences10/pi-lsp 0.0.50 → 0.0.52

package/README.md

@@ -11,6 +11,10 @@
 
 <!-- package-readme:header:end -->
 
+Prompt guidance uses Pi's named system-prompt sections. It coexists
+with user `SYSTEM.md` and `APPEND_SYSTEM.md` files and other
+extensions without replacing the complete prompt.
+
 Give agents precise code intelligence instead of guesswork. `pi-lsp`
 exposes language-server diagnostics, hovers, definitions, references,
 and symbols as Pi tools so models can validate edits and navigate
@@ -141,10 +145,22 @@ trust prompts follow tool cancellation and time out after 30 seconds,
 returning a tool error instead of leaving the session indefinitely in
 `Working`.
 
-Language servers receive a restricted child-process environment by
-default. Use `MY_PI_LSP_ENV_ALLOWLIST=NAME,OTHER_NAME` or the shared
-`MY_PI_CHILD_ENV_ALLOWLIST` to pass selected ambient variables
-through.
+### Language-server environment
+
+LSP filters its language-server environment directly, passing only
+`PATH`, `PI_CODING_AGENT_DIR`, home/user, locale (`LANG` and `LC_*`),
+terminal/color, shell, temporary-directory, and CI variables by
+default. Provider credentials, Pi session metadata, `NODE_OPTIONS`,
+and other ambient variables are not inherited unless explicitly
+allowlisted.
+
+Use `MY_PI_LSP_ENV_ALLOWLIST=NAME,OTHER_NAME` to pass toolchain
+configuration such as `RUSTUP_HOME`, `CARGO_HOME`, or `JAVA_HOME` when
+needed. `MY_PI_CHILD_ENV_ALLOWLIST` remains supported; entries from
+both lists are combined.
+
+This reduces ambient credential exposure, but is not a sandbox:
+language servers retain the current user's filesystem permissions.
 
 ## Tools
 

package/dist/env.js

@@ -1,9 +1,47 @@
-import { create_child_process_env as create_shared_child_process_env } from '@spences10/pi-child-env';
+const BASE_CHILD_ENV_KEYS = new Set([
+    'CI',
+    'COLORTERM',
+    'FORCE_COLOR',
+    'HOME',
+    'LANG',
+    'LOGNAME',
+    'NO_COLOR',
+    'PATH',
+    'PI_CODING_AGENT_DIR',
+    'SHELL',
+    'TEMP',
+    'TERM',
+    'TMP',
+    'TMPDIR',
+    'USER',
+]);
+const ENV_ALLOWLIST_KEYS = [
+    'MY_PI_CHILD_ENV_ALLOWLIST',
+    'MY_PI_LSP_ENV_ALLOWLIST',
+];
 export function create_child_process_env(explicit_env = {}, source_env = process.env) {
-    return create_shared_child_process_env({
-        profile: 'lsp',
-        explicit_env,
-        source_env,
-    });
+    const env = {};
+    const allowed_keys = new Set(BASE_CHILD_ENV_KEYS);
+    for (const key of Object.keys(source_env)) {
+        if (key.startsWith('LC_'))
+            allowed_keys.add(key);
+    }
+    for (const allowlist_key of ENV_ALLOWLIST_KEYS) {
+        for (const entry of (source_env[allowlist_key] ?? '').split(',')) {
+            const key = entry.trim();
+            if (key)
+                allowed_keys.add(key);
+        }
+    }
+    for (const key of allowed_keys) {
+        const value = source_env[key];
+        if (typeof value === 'string')
+            env[key] = value;
+    }
+    for (const [key, value] of Object.entries(explicit_env)) {
+        if (typeof value === 'string')
+            env[key] = value;
+    }
+    return env;
 }
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAEtG,MAAM,UAAU,wBAAwB,CACvC,YAAY,GAA2B,EAAE,EACzC,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,OAAO,+BAA+B,CAAC;QACtC,OAAO,EAAE,KAAK;QACd,YAAY;QACZ,UAAU;KACV,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,WAAW;IACX,aAAa;IACb,MAAM;IACN,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,qBAAqB;IACrB,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;CACN,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG;IAC1B,2BAA2B;IAC3B,yBAAyB;CACzB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CACvC,YAAY,GAA2B,EAAE,EACzC,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,kBAAkB,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAC1D,GAAG,CACH,EAAE,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/dist/index.js

@@ -1,5 +1,5 @@
 import { register_lsp_command } from './commands.js';
-import { append_lsp_system_prompt, should_inject_lsp_prompt, } from './prompt.js';
+import { LSP_SYSTEM_PROMPT, should_inject_lsp_prompt, } from './prompt.js';
 import { LspServerManager, } from './server-manager.js';
 import { register_lsp_tools } from './tools.js';
 export { should_inject_lsp_prompt } from './prompt.js';
@@ -8,11 +8,13 @@ export function create_lsp_extension(options = {}) {
         const manager = new LspServerManager(options);
         register_lsp_tools(pi, manager);
         pi.on('before_agent_start', async (event) => {
-            if (!should_inject_lsp_prompt(event))
-                return {};
-            return {
-                systemPrompt: append_lsp_system_prompt(event.systemPrompt),
-            };
+            if (should_inject_lsp_prompt(event)) {
+                event.systemPromptOptions.sections.lsp =
+                    LSP_SYSTEM_PROMPT.trim();
+            }
+            else {
+                delete event.systemPromptOptions.sections.lsp;
+            }
         });
         register_lsp_command(pi, manager);
         pi.on('session_shutdown', async () => {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACN,wBAAwB,EACxB,wBAAwB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,gBAAgB,GAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKvD,MAAM,UAAU,oBAAoB,CACnC,OAAO,GAA8B,EAAE;IAEvC,OAAO,KAAK,UAAU,GAAG,CAAC,EAAgB;QACzC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3C,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YAChD,OAAO;gBACN,YAAY,EAAE,wBAAwB,CAAC,KAAK,CAAC,YAAY,CAAC;aAC1D,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAElC,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED,eAAe,oBAAoB,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EACN,iBAAiB,EACjB,wBAAwB,GACxB,MAAM,aAAa,CAAC;AACrB,OAAO,EACN,gBAAgB,GAEhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAKvD,MAAM,UAAU,oBAAoB,CACnC,OAAO,GAA8B,EAAE;IAEvC,OAAO,KAAK,UAAU,GAAG,CAAC,EAAgB;QACzC,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAE9C,kBAAkB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAEhC,EAAE,CAAC,EAAE,CAAC,oBAAoB,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC3C,IAAI,wBAAwB,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG;oBACrC,iBAAiB,CAAC,IAAI,EAAE,CAAC;YAC3B,CAAC;iBAAM,CAAC;gBACP,OAAO,KAAK,CAAC,mBAAmB,CAAC,QAAQ,CAAC,GAAG,CAAC;YAC/C,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,oBAAoB,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAElC,EAAE,CAAC,EAAE,CAAC,kBAAkB,EAAE,KAAK,IAAI,EAAE;YACpC,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC;QACtC,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC;AAED,eAAe,oBAAoB,EAAE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spences10/pi-lsp",
-  "version": "0.0.50",
+  "version": "0.0.52",
   "description": "Language Server Protocol tools for Pi agents to inspect diagnostics, hovers, definitions, references, and symbols",
   "keywords": [
     "language-server",
@@ -33,7 +33,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@spences10/pi-child-env": "0.2.0",
     "@spences10/pi-project-trust": "0.1.0",
     "@spences10/pi-tui-modal": "0.0.24"
   },