@trim21/personal-pi-extensions 0.0.183 → 0.0.186

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.183",
+  "version": "0.0.186",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/index.ts

@@ -11,11 +11,12 @@
  *
  * ## Modes
  *
- * Three modes, switchable at runtime:
+ * Four modes, switchable at runtime:
  *
  *   allow-all       No sandbox. Network allowed. All commands run natively.
  *   workspace-write Sandbox enabled, network blocked. Project dir + /tmp writable.
  *                   Model can request full access via bash tool parameter.
+ *   allow-net       Sandbox enabled, network allowed. Project dir + /tmp writable.
  *   readonly        Sandbox enabled, network blocked, no writable paths.
  *
  * ## Escalation
@@ -45,6 +46,7 @@
  *   /bwrap              Show current mode and paths
  *   /bwrap-allow-all    Full access, sandbox off
  *   /bwrap-workspace-write  Sandbox on, workspace writable
+ *   /bwrap-allow-net    Sandbox on, network on, workspace writable
  *   /bwrap-readonly     Sandbox on, no writes
  *
  * Usage:
@@ -73,8 +75,9 @@ Three sandbox modes exist:
 - allow-all: sandbox off, network on, full access
 - readonly: sandbox on, network off, nothing writable
 - workspace-write: sandbox on, network off, only workspace and /tmp writable
+- allow-net: sandbox on, network on, only workspace and /tmp writable
 
-In workspace-write and readonly modes, the bash tool has a
+In workspace-write, allow-net and readonly modes, the bash tool has a
 \`request_full_access\` boolean parameter.
 Set it to true to request execution outside the sandbox.
 The user must approve.
@@ -92,7 +95,8 @@ require request_full_access: true.
 
 the \`request_full_access\` is only needed for:
   - Writing to paths outside the configured writable directories,
-  - Operations requiring network access (curl, npm install, git push, etc.).
+  - Operations requiring network access when the current mode blocks it
+    (workspace-write or readonly; allow-all and allow-net already have network).
 Writing inside the workspace or /tmp, or reading any file, does not require escalation,
 for example, the simple \`ls\`, \`cat\`, \`find\` or \`grep\` and git command that only read from .git directory but not change .git directory and other read only commands.
 **If the command is readonly operator, do not use \`request_full_access\`**
@@ -146,7 +150,7 @@ function findBwrap(override?: string): string {
   return override ?? bwrapPath;
 }
 
-type BwrapMode = "allow-all" | "workspace-write" | "readonly";
+type BwrapMode = "allow-all" | "workspace-write" | "allow-net" | "readonly";
 
 export interface BwrapConfig {
   mode: BwrapMode;
@@ -168,7 +172,7 @@ export interface ResolvedBwrap {
   extraArgs: string[];
 }
 
-function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
+export function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
   const base = {
     mode: config.mode,
     bwrapPath: config.bwrapPath,
@@ -184,6 +188,9 @@ function resolveBwrap(config: BwrapConfig): ResolvedBwrap {
     case "workspace-write": {
       return { ...base, bwrapEnabled: true, network: false };
     }
+    case "allow-net": {
+      return { ...base, bwrapEnabled: true, network: true };
+    }
     case "readonly": {
       return { ...base, bwrapEnabled: true, network: false, writablePaths: [] };
     }
@@ -508,6 +515,7 @@ function notifyMode(
   const labels: Record<BwrapMode, string> = {
     "allow-all": "allow-all: sandbox off, network on",
     "workspace-write": "workspace-write: sandbox on, network off",
+    "allow-net": "allow-net: sandbox on, network on, workspace writable",
     readonly: "readonly: sandbox on, network off, read-only fs",
   };
   ctx.ui.notify(labels[mode], "info");
@@ -768,6 +776,11 @@ export default function bwrapExtension(pi: ExtensionAPI) {
     handler: (_args, ctx) => Promise.resolve(switchMode("workspace-write", ctx)),
   });
 
+  pi.registerCommand("bwrap-allow-net", {
+    description: "Sandbox on, network on, workspace writable",
+    handler: (_args, ctx) => Promise.resolve(switchMode("allow-net", ctx)),
+  });
+
   pi.registerCommand("bwrap-readonly", {
     description: "Sandbox on, network off, no writes",
     handler: (_args, ctx) => Promise.resolve(switchMode("readonly", ctx)),

package/src/gh-readonly.ts

@@ -206,11 +206,22 @@ const jobRunSchema = Type.Object({
   name: Type.String(),
   status: Type.String(),
   conclusion: Type.Union([Type.String(), Type.Null()]),
+  html_url: Type.Optional(Type.String()),
   steps: Type.Array(stepSchema),
 });
 
 const jobsResponseSchema = Type.Object({ jobs: Type.Array(jobRunSchema) });
 
+const prHeadSchema = Type.Object({ headRefOid: Type.String() });
+
+const workflowRunSchema = Type.Object({
+  id: Type.Number(),
+  name: Type.String(),
+  html_url: Type.String(),
+});
+
+const workflowRunsSchema = Type.Object({ workflow_runs: Type.Array(workflowRunSchema) });
+
 function truncate(
   text: string,
   maxLines = 2000,
@@ -401,6 +412,15 @@ async function resolveRepo(
   return nameWithOwner;
 }
 
+/** Job conclusions that count as "did not succeed" for CI result reporting. */
+const FAILED_JOB_CONCLUSIONS = new Set([
+  "failure",
+  "timed_out",
+  "action_required",
+  "startup_failure",
+  "cancelled",
+]);
+
 export function statusIcon(conclusion: string | null): string {
   switch (conclusion) {
     case "success": {
@@ -1311,29 +1331,115 @@ export default function ghReadonlyTools(pi: ExtensionAPI) {
       const args = ["pr", "checks", String(number), ...repoArgs(repo), "--watch"];
       if (fail_fast) args.push("--fail-fast");
 
+      // gh 的退出码语义不可靠：checks 失败时返回 exit 1（SilentError），挂起时
+      // 返回 exit 8（PendingError），且失败详情只在非结构化的 stdout 表格里。
+      // 因此 watch 退出后直接用 Actions API 抓取该 PR head 提交关联的所有
+      // workflow job，以 job 的真实 conclusion 为准判断成功/失败。
       const result = await runGh(args, { cwd: ctx.cwd, signal, timeout: 600_000 });
+      if (result.killed) {
+        throw new Error(
+          result.reason === "timeout"
+            ? "gh pr checks --watch timed out after 10 minutes"
+            : "gh pr checks --watch was aborted",
+        );
+      }
 
-      const exitCode = result.code;
-      const stdout = result.stdout;
-      const stderr = result.stderr;
+      const effectiveRepo = await resolveRepo(repo, signal, ctx.cwd, params);
+      const prOut = await ghExec(
+        ["pr", "view", String(number), "--repo", effectiveRepo, "--json", "headRefOid"],
+        { cwd: ctx.cwd, signal, input: params },
+      );
+      const { headRefOid } = Value.Parse(prHeadSchema, JSON.parse(prOut));
+
+      onUpdate?.({
+        content: [{ type: "text", text: `Fetching workflow jobs for PR #${number}...` }],
+        details: {},
+      });
+
+      const runsOut = await ghExec(
+        ["api", `/repos/${effectiveRepo}/actions/runs?head_sha=${headRefOid}&per_page=100`],
+        { cwd: ctx.cwd, signal, input: params },
+      );
+      const { workflow_runs } = Value.Parse(workflowRunsSchema, JSON.parse(runsOut));
+
+      const failedJobs: {
+        runId: number;
+        runName: string;
+        runUrl: string;
+        jobId: number;
+        jobName: string;
+        conclusion: string;
+        jobUrl?: string;
+      }[] = [];
+      let totalJobs = 0;
+
+      for (const run of workflow_runs) {
+        const jobsOut = await ghExec(
+          ["api", `/repos/${effectiveRepo}/actions/runs/${run.id}/jobs?per_page=100`],
+          { cwd: ctx.cwd, signal, input: params },
+        );
+        const { jobs } = Value.Parse(jobsResponseSchema, JSON.parse(jobsOut));
+        totalJobs += jobs.length;
+
+        for (const job of jobs) {
+          if (!job.conclusion || FAILED_JOB_CONCLUSIONS.has(job.conclusion)) {
+            failedJobs.push({
+              runId: run.id,
+              runName: run.name,
+              runUrl: run.html_url,
+              jobId: job.id,
+              jobName: job.name,
+              conclusion: job.conclusion ?? "in_progress",
+              jobUrl: job.html_url,
+            });
+          }
+        }
+      }
 
-      // Exit code 2 means one or more checks failed
-      if (exitCode === 2) {
+      if (totalJobs === 0) {
         return {
           content: [
-            { type: "text", text: `## PR #${number} CI Checks - FAILED\n\n${stdout}\n${stderr}` },
+            {
+              type: "text",
+              text: `## PR #${number} CI Checks\n\nNo workflow runs found for head commit ${headRefOid.slice(0, 7)}.`,
+            },
           ],
-          details: { status: "failure", exitCode, input: params },
+          details: { status: "no-jobs", totalJobs: 0, input: params },
         };
       }
 
-      if (exitCode !== 0) {
-        throw new Error(`gh pr checks --watch failed: ${stderr || `exit code ${exitCode}`}`);
+      if (failedJobs.length > 0) {
+        const lines = failedJobs.map(
+          (j) =>
+            `- ${statusIcon(j.conclusion)} **${j.jobName}** (${j.conclusion}) — [job #${j.jobId}](${j.jobUrl ?? j.runUrl})\n` +
+            `  - workflow: [${j.runName} (#${j.runId})](${j.runUrl})`,
+        );
+        return {
+          content: [
+            {
+              type: "text",
+              text:
+                `## PR #${number} CI Checks - FAILED\n\n` +
+                `${failedJobs.length} of ${totalJobs} job(s) did not succeed:\n\n${lines.join("\n")}`,
+            },
+          ],
+          details: {
+            status: "failure",
+            totalJobs,
+            failedJobs,
+            input: params,
+          },
+        };
       }
 
       return {
-        content: [{ type: "text", text: `## PR #${number} CI Checks - PASSED\n\n${stdout}` }],
-        details: { status: "success", exitCode: 0, input: params },
+        content: [
+          {
+            type: "text",
+            text: `## PR #${number} CI Checks - PASSED\n\nAll ${totalJobs} job(s) succeeded.`,
+          },
+        ],
+        details: { status: "success", totalJobs, input: params },
       };
     },
   });