@spences10/pi-lsp 0.0.51 → 0.0.52

package/README.md

@@ -145,10 +145,22 @@ trust prompts follow tool cancellation and time out after 30 seconds,
 returning a tool error instead of leaving the session indefinitely in
 `Working`.
 
-Language servers receive a restricted child-process environment by
-default. Use `MY_PI_LSP_ENV_ALLOWLIST=NAME,OTHER_NAME` or the shared
-`MY_PI_CHILD_ENV_ALLOWLIST` to pass selected ambient variables
-through.
+### Language-server environment
+
+LSP filters its language-server environment directly, passing only
+`PATH`, `PI_CODING_AGENT_DIR`, home/user, locale (`LANG` and `LC_*`),
+terminal/color, shell, temporary-directory, and CI variables by
+default. Provider credentials, Pi session metadata, `NODE_OPTIONS`,
+and other ambient variables are not inherited unless explicitly
+allowlisted.
+
+Use `MY_PI_LSP_ENV_ALLOWLIST=NAME,OTHER_NAME` to pass toolchain
+configuration such as `RUSTUP_HOME`, `CARGO_HOME`, or `JAVA_HOME` when
+needed. `MY_PI_CHILD_ENV_ALLOWLIST` remains supported; entries from
+both lists are combined.
+
+This reduces ambient credential exposure, but is not a sandbox:
+language servers retain the current user's filesystem permissions.
 
 ## Tools
 

package/dist/env.js

@@ -1,9 +1,47 @@
-import { create_child_process_env as create_shared_child_process_env } from '@spences10/pi-child-env';
+const BASE_CHILD_ENV_KEYS = new Set([
+    'CI',
+    'COLORTERM',
+    'FORCE_COLOR',
+    'HOME',
+    'LANG',
+    'LOGNAME',
+    'NO_COLOR',
+    'PATH',
+    'PI_CODING_AGENT_DIR',
+    'SHELL',
+    'TEMP',
+    'TERM',
+    'TMP',
+    'TMPDIR',
+    'USER',
+]);
+const ENV_ALLOWLIST_KEYS = [
+    'MY_PI_CHILD_ENV_ALLOWLIST',
+    'MY_PI_LSP_ENV_ALLOWLIST',
+];
 export function create_child_process_env(explicit_env = {}, source_env = process.env) {
-    return create_shared_child_process_env({
-        profile: 'lsp',
-        explicit_env,
-        source_env,
-    });
+    const env = {};
+    const allowed_keys = new Set(BASE_CHILD_ENV_KEYS);
+    for (const key of Object.keys(source_env)) {
+        if (key.startsWith('LC_'))
+            allowed_keys.add(key);
+    }
+    for (const allowlist_key of ENV_ALLOWLIST_KEYS) {
+        for (const entry of (source_env[allowlist_key] ?? '').split(',')) {
+            const key = entry.trim();
+            if (key)
+                allowed_keys.add(key);
+        }
+    }
+    for (const key of allowed_keys) {
+        const value = source_env[key];
+        if (typeof value === 'string')
+            env[key] = value;
+    }
+    for (const [key, value] of Object.entries(explicit_env)) {
+        if (typeof value === 'string')
+            env[key] = value;
+    }
+    return env;
 }
 //# sourceMappingURL=env.js.map

package/dist/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,IAAI,+BAA+B,EAAE,MAAM,yBAAyB,CAAC;AAEtG,MAAM,UAAU,wBAAwB,CACvC,YAAY,GAA2B,EAAE,EACzC,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,OAAO,+BAA+B,CAAC;QACtC,OAAO,EAAE,KAAK;QACd,YAAY;QACZ,UAAU;KACV,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../src/env.ts"],"names":[],"mappings":"AAAA,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,WAAW;IACX,aAAa;IACb,MAAM;IACN,MAAM;IACN,SAAS;IACT,UAAU;IACV,MAAM;IACN,qBAAqB;IACrB,OAAO;IACP,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;CACN,CAAC,CAAC;AAEH,MAAM,kBAAkB,GAAG;IAC1B,2BAA2B;IAC3B,yBAAyB;CACzB,CAAC;AAEF,MAAM,UAAU,wBAAwB,CACvC,YAAY,GAA2B,EAAE,EACzC,UAAU,GAAsB,OAAO,CAAC,GAAG;IAE3C,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,IAAI,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,MAAM,aAAa,IAAI,kBAAkB,EAAE,CAAC;QAChD,KAAK,MAAM,KAAK,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAC1D,GAAG,CACH,EAAE,CAAC;YACH,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YACzB,IAAI,GAAG;gBAAE,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IACD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACzD,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACjD,CAAC;IAED,OAAO,GAAG,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@spences10/pi-lsp",
-  "version": "0.0.51",
+  "version": "0.0.52",
   "description": "Language Server Protocol tools for Pi agents to inspect diagnostics, hovers, definitions, references, and symbols",
   "keywords": [
     "language-server",
@@ -33,7 +33,6 @@
     "access": "public"
   },
   "dependencies": {
-    "@spences10/pi-child-env": "0.2.0",
     "@spences10/pi-project-trust": "0.1.0",
     "@spences10/pi-tui-modal": "0.0.24"
   },