@trim21/personal-pi-extensions 0.0.271 → 0.0.273

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.271",
+  "version": "0.0.273",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/runtime.ts

@@ -224,6 +224,12 @@ export class BwrapRuntime {
       this.sandboxDisabled = pi.getFlag("no-bwrap") === true && ctx.hasUI;
       this.resolved = undefined;
       this.bwrapUnavailable = false;
+      if (process.platform === "win32") {
+        // Windows 没有 bubblewrap：不做 bwrap 检测、不显示 bwrap 状态，
+        // 每条 bash 命令在 execute 时逐条人工审批，模型无需知道 bwrap 的存在。
+        ctx.ui.notify("Every bash command requires user approval before it runs.", "info");
+        return;
+      }
       const runtime = this.resolve(ctx);
       if (runtime.bwrapEnabled) {
         try {
@@ -254,12 +260,18 @@ export class BwrapRuntime {
 
     pi.on("before_agent_start", (event, ctx) => {
       const runtime = this.resolve(ctx);
+      const isWindows = process.platform === "win32";
       const modeText = ctx.hasUI
-        ? `Current bwrap mode: **${runtime.mode}**. The bwrap runtime selects sandboxing and, when requested, user approval for unsandboxed execution.`
-        : "This headless session is forced into bwrap readonly mode. Unsandboxed execution cannot be approved.";
-      const unavailableText = this.bwrapUnavailable
-        ? " bwrap is unavailable (binary not found): bash commands are refused unless the user explicitly approves unsandboxed execution."
-        : "";
+        ? isWindows
+          ? "Every bash command requires user approval before it runs."
+          : `Current bwrap mode: **${runtime.mode}**. The bwrap runtime selects sandboxing and, when requested, user approval for unsandboxed execution.`
+        : isWindows
+          ? "This headless session cannot approve commands: bash commands are refused."
+          : "This headless session is forced into bwrap readonly mode. Unsandboxed execution cannot be approved.";
+      const unavailableText =
+        !isWindows && this.bwrapUnavailable
+          ? " bwrap is unavailable (binary not found): bash commands are refused unless the user explicitly approves unsandboxed execution."
+          : "";
       return {
         systemPrompt:
           event.systemPrompt + `\n\n## Command Execution\n${modeText}${unavailableText}\n`,
@@ -283,13 +295,24 @@ export class BwrapRuntime {
 
   async execute(request: BwrapExecutionRequest): Promise<BwrapExecutionResult> {
     const runtime = this.resolve(request.ctx);
-    if (this.bwrapUnavailable && runtime.bwrapEnabled && request.requestFullAccess !== true) {
+    const isWindows = process.platform === "win32";
+    // 非 Windows：bwrap 缺失时 fail closed，普通命令一律拒绝（除非显式 full-access 审批）。
+    // Windows：没有 bubblewrap，这是预期状态，降级为每条命令都走人工审核。
+    if (
+      !isWindows &&
+      this.bwrapUnavailable &&
+      runtime.bwrapEnabled &&
+      request.requestFullAccess !== true
+    ) {
       throw new Error(
         "bwrap (bubblewrap) not found; refusing to execute commands without sandboxing. " +
           "Install bubblewrap and restart the session, or pass --no-bwrap to disable the sandbox explicitly.",
       );
     }
-    if (request.requestFullAccess === true && runtime.bwrapEnabled) {
+    // 需要人工审批：非 Windows 仅 requestFullAccess；Windows 上默认所有命令
+    // （allow-all 模式是显式 opt-out，仍直接执行）。
+    const needsApproval = request.requestFullAccess === true || (isWindows && runtime.bwrapEnabled);
+    if (needsApproval && runtime.bwrapEnabled) {
       // 先按 approvalRules 自动判定：allow 直接放行，deny 直接拒绝，未命中才弹框
       const decision = await evaluateBashApproval(request.command, runtime.approvalRules);
       if (decision === "deny") {
@@ -300,9 +323,9 @@ export class BwrapRuntime {
       }
     }
     const operations =
-      runtime.bwrapEnabled && request.requestFullAccess !== true
-        ? createBwrapBashOperations(runtime)
-        : createLocalBashOperations();
+      isWindows || needsApproval || !runtime.bwrapEnabled
+        ? createLocalBashOperations()
+        : createBwrapBashOperations(runtime);
     const output = new BashOutput();
     const { onUpdate } = request;
 
@@ -389,15 +412,36 @@ export class BwrapRuntime {
   ): Promise<void> {
     const policy = resolveEscalation({ hasUI: ctx.hasUI });
     if (policy.kind === "deny") throw new Error(policy.reason);
+    // 弹框前解析命令的持久化规则（Allow forever 会写入），在弹框里预览给
+    // 用户：`echo 1` → `echo *`，避免用户对"永久允许"持久化什么一无所知。
+    const patterns = await commandPatternsFor(command);
     // dcg 扫描建议是可选的参考文本：未安装时静默跳过；已安装但扫描失败
     // 时 notify 提示，弹窗本身与无 dcg 时一致
     const outcome = await dcgSuggestion(command);
-    const suggestionBlock =
-      outcome.kind === "suggestion" ? `\n${outcome.suggestion.text}\n---\n` : "";
     if (outcome.kind === "failed") {
       ctx.ui.notify(`dcg 扫描失败，本次无破坏性命令建议: ${outcome.detail}`, "warning");
     }
-    const description = `Allow this command to run without sandbox?\n---\n\nReason: ${escapeHtml(reason ?? "(No reason provided by model)")}\n---\n${suggestionBlock}${fenceCodeBlock(command)}`;
+    // 弹框主体按行组织（'\n' join），便于 review；suggestion 与 forever 预览
+    // 块带前导空行 + 尾部 "---" 分隔，输出与历史逐字符一致。
+    const lines: string[] = [
+      "Allow this command to run without sandbox?",
+      "---",
+      "",
+      `Reason: ${escapeHtml(reason ?? "(No reason provided by model)")}`,
+      "---",
+    ];
+    if (outcome.kind === "suggestion") {
+      lines.push("", outcome.suggestion.text, "---");
+    }
+    if (patterns.length > 0) {
+      lines.push(
+        "",
+        `Allow forever 将持久化规则: ${patterns.map((pattern) => `\`${pattern}\``).join(", ")}`,
+        "---",
+      );
+    }
+    lines.push(fenceCodeBlock(command));
+    const description = lines.join("\n");
 
     // 单选：允许一次 / 永久允许（写入规则）/ 拒绝 / 拒绝并附理由（弹输入框）
     const verdict = await selectWithOptionalInput(description, FULL_ACCESS_CHOICES, ctx.ui, {
@@ -413,7 +457,7 @@ export class BwrapRuntime {
         return;
       }
       case ALLOW_FOREVER: {
-        await this.persistAllowRule(ctx, command);
+        await this.persistAllowRule(ctx, command, patterns);
         return;
       }
       case DENY: {
@@ -431,10 +475,14 @@ export class BwrapRuntime {
   }
 
   /** 把命令的权限模式写入项目 bwrap.json 的 approvalRules（allow forever）。 */
-  private async persistAllowRule(ctx: ExtensionContext, command: string): Promise<void> {
-    const patterns = await commandPatternsFor(command);
-    if (patterns.length === 0) return; // 解析失败：本次放行，不写规则
-    const newRules: ApprovalRule[] = patterns.map((pattern) => ({ action: "allow", pattern }));
+  private async persistAllowRule(
+    ctx: ExtensionContext,
+    command: string,
+    patterns?: string[],
+  ): Promise<void> {
+    const rulePatterns = patterns ?? (await commandPatternsFor(command));
+    if (rulePatterns.length === 0) return; // 解析失败：本次放行，不写规则
+    const newRules: ApprovalRule[] = rulePatterns.map((pattern) => ({ action: "allow", pattern }));
     const { project } = getBwrapConfigPaths(ctx.cwd);
     let config: Record<string, unknown> = {};
     if (existsSync(project)) {

package/src/gh-readonly.ts

@@ -34,10 +34,12 @@ import { mkdir, readFile, writeFile } from "node:fs/promises";
 import { homedir } from "node:os";
 import { delimiter, dirname, join, resolve } from "node:path";
 
-import { type ExtensionAPI, withFileMutationQueue } from "@earendil-works/pi-coding-agent";
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 
+import { createSeqState } from "./lib/seq-state.js";
+
 interface GhResult {
   stdout: string;
   stderr: string;
@@ -380,8 +382,9 @@ export function stepsDetail(
   }));
 }
 
-/** In-flight dedup map to avoid concurrent fetches of the same log. */
-const inflightLogs = new Map<string, Promise<string>>();
+// 模块级串行状态：同一资源（如 CI 日志）的请求排队执行，配合函数内部的
+// 缓存检查避免重复网络请求。闭包状态不与其他扩展共享，key 无需全局前缀。
+const seq = createSeqState();
 
 async function getJobLog(
   runId: string,
@@ -393,13 +396,10 @@ async function getJobLog(
 ): Promise<string> {
   const cacheDir = join(homedir(), ".cache", "pi", "ci-logs", runId);
   const cacheFile = join(cacheDir, `${jobId}.log`);
-  const key = `${runId}:${jobId}`;
-
-  // Check in-flight dedup map
-  const inflight = inflightLogs.get(key);
-  if (inflight) return inflight;
 
-  const fetchAndCache = async (): Promise<string> => {
+  // 同一 runId:jobId 的请求串行执行：后一个进入时缓存已写入，直接命中缓存，
+  // 不会重复发网络请求；串行也保证不会有两个并发写同一 cache 文件。
+  return seq.execute(`${runId}:${jobId}`, async () => {
     // Check file cache
     try {
       return await readFile(cacheFile, "utf8");
@@ -424,20 +424,10 @@ async function getJobLog(
 
     // Write to cache
     await mkdir(cacheDir, { recursive: true });
-    await withFileMutationQueue(cacheFile, async () => {
-      await writeFile(cacheFile, log);
-    });
+    await writeFile(cacheFile, log);
 
     return log;
-  };
-
-  const promise = fetchAndCache();
-  inflightLogs.set(key, promise);
-  try {
-    return await promise;
-  } finally {
-    inflightLogs.delete(key);
-  }
+  });
 }
 
 async function resolveRepo(
@@ -1061,9 +1051,7 @@ export async function writeLogFile(
 
   const target = resolve(cwd ?? process.cwd(), outputFile);
   await mkdir(dirname(target), { recursive: true });
-  await withFileMutationQueue(target, async () => {
-    await writeFile(target, content);
-  });
+  await writeFile(target, content);
 
   const lines = content.split("\n").length;
   const bytes = Buffer.byteLength(content, "utf8");
@@ -1098,6 +1086,15 @@ export async function writeLogFile(
 // ── tools ────────────────────────────────────────────────────────────────────
 
 export default function ghReadonlyTools(pi: ExtensionAPI) {
+  // Windows 上禁用：gh 可执行文件的探测（无扩展名 + POSIX 路径）与进程
+  // 管理（SIGTERM 信号语义）都是 POSIX 假设，不做 Windows 适配。
+  if (process.platform === "win32") {
+    pi.on("session_start", (_event, ctx) => {
+      ctx.ui.notify("gh-readonly tools are disabled on Windows.", "warning");
+    });
+    return;
+  }
+
   // Fail fast: the `gh` CLI is the only backend for these tools. Without it the
   // extension registers nothing and reports the problem at session start, so
   // the user gets one clear error instead of a dozen failing tool calls.

package/src/lib/seq-state.ts

@@ -0,0 +1,34 @@
+/**
+ * 按 key 串行化并发任务：同一 key 的调用排队执行，前一个 settle（无论成败）
+ * 后才执行下一个。key 由调用方自定义（如资源 id），每个 `createSeqState()`
+ * 返回独立的闭包状态，不同扩展之间不串扰。
+ */
+
+export interface SeqState {
+  execute<T>(key: string, fn: () => Promise<T>): Promise<T>;
+}
+
+export function createSeqState(): SeqState {
+  const tails = new Map<string, Promise<unknown>>();
+
+  return {
+    execute<T>(key: string, fn: () => Promise<T>): Promise<T> {
+      const previous = tails.get(key) ?? Promise.resolve();
+
+      // 等前一个任务 settle 后执行本任务。previous 恒为 resolve（tail 吞掉了错误），
+      // 失败不会阻塞后续任务。
+      const run = previous.then(() => fn());
+
+      // 本任务的完成占位：永远 resolve，作为下一个任务的等待点。
+      // eslint-disable-next-line unicorn/no-useless-undefined -- 显式返回 undefined：吞掉前序错误并归一化为成功占位
+      const tail = run.catch(() => undefined);
+
+      tails.set(key, tail);
+      void tail.finally(() => {
+        if (tails.get(key) === tail) tails.delete(key);
+      });
+
+      return run;
+    },
+  };
+}

package/src/lib/write-guard.ts

@@ -6,6 +6,8 @@
  * - Paths outside require user approval via a confirmation dialog showing a
  *   `diff` code block preview of the pending change.
  * - Headless sessions (no UI) reject outside writes outright.
+ * - Windows (no sandbox fallback): writes are restricted to the workspace;
+ *   outside paths are rejected outright, with no approval path.
  *
  * Callers have already parsed their tool arguments, so the guard only takes the
  * resolved pieces: the raw target path and the pending change (oldText/newText).
@@ -122,6 +124,14 @@ export async function guardWriteAccess(
   const { absolutePath } = opts;
   if (isPathAllowed(absolutePath, ctx.cwd)) return;
 
+  if (process.platform === "win32") {
+    // Windows 上退化为「只能写工作区」：无沙箱兜底，工作区外写入一律拒绝，
+    // 不提供审批路径。
+    throw new Error(
+      `Path "${absolutePath}" is outside workspace. Writes outside the workspace are not allowed on Windows.`,
+    );
+  }
+
   if (!ctx.hasUI || !ctx.ui) {
     throw new Error(`Path "${absolutePath}" is outside workspace. No UI available for approval.`);
   }

package/src/spawn-agent.ts

@@ -544,6 +544,16 @@ export function formatAgentListSection(agents: AgentConfig[]): string {
 // ── extension ────────────────────────────────────────────────────────────────
 
 export default function spawnAgent(pi: ExtensionAPI) {
+  // Windows 上禁用：子代理进程的派生（node/bun 运行时下回退到 `pi` 命令，
+  // 而 npm 安装的 pi 是 .cmd shim，spawn 无法直接启动）与信号管理都是
+  // POSIX 假设，不做 Windows 适配。
+  if (process.platform === "win32") {
+    pi.on("session_start", (_event, ctx) => {
+      ctx.ui.notify("spawn-agent is disabled on Windows.", "warning");
+    });
+    return;
+  }
+
   // Discover the available subagent types once at extension startup. The
   // extension owns this discovery: the model never has to guess agent names
   // or read the agent directory itself. Editing ~/.pi/agent/agents/*.md