@trim21/personal-pi-extensions 0.0.398 → 0.0.400

package/README.md

@@ -52,7 +52,9 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 
 ### 保护目录
 
-`.git`、`.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读。
+`.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读；`.git` 同样只读：工作区根是 git 仓库时保护根 `.git`，根不是 git 仓库时才递归扫描嵌套仓库（monorepo 子仓库，跳过 `node_modules`、`.venv` 等包目录）。
+
+可写与保护路径均使用 bwrap 的 `--*-bind-try` 变体：路径不存在时自动忽略该项，而不是让整条命令失败。
 
 ### 运行时命令
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.398",
+  "version": "0.0.400",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -1,6 +1,6 @@
 import { type ChildProcess, spawn } from "node:child_process";
-import { closeSync, constants, existsSync, openSync, readFileSync } from "node:fs";
-import { access as fsAccess } from "node:fs/promises";
+import { closeSync, constants, type Dirent, existsSync, openSync, readFileSync } from "node:fs";
+import { access as fsAccess, readdir, stat } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -12,7 +12,7 @@ import { Value } from "typebox/value";
 import { expandHome } from "../lib/path.js";
 import { type ApprovalRule } from "./approval-rules.js";
 
-const PROTECTED_DIRS = [".git", ".pi", ".agent"];
+const PROTECTED_DIRS = [".pi", ".agent"];
 
 export const BWRAP_MODES = ["allow-all", "workspace-write", "allow-net", "readonly"] as const;
 
@@ -190,23 +190,96 @@ export function findBwrap(override?: string): string {
   return findDefaultBwrap();
 }
 
-export function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): string[] {
+/** 扫描 .git 时跳过的目录：包/依赖/构建产物，嵌套 git 仓库几乎不会出现在这里。 */
+const GIT_DIR_SCAN_SKIP = new Set([
+  "node_modules",
+  ".venv",
+  "venv",
+  ".venvs",
+  "dist",
+  "build",
+  "target",
+  "__pycache__",
+  ".next",
+  ".cache",
+  ".turbo",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".hg",
+  ".svn",
+]);
+
+/** 最多收集的 .git 数量与扫描深度，防止异常大的工作区拖慢每条命令。 */
+const MAX_GIT_DIRS = 64;
+const MAX_GIT_SCAN_DEPTH = 24;
+
+class ScanLimitError extends Error {}
+
+/**
+ * 递归扫描工作区，收集所有 `.git` 目录的绝对路径（monorepo / 嵌套仓库）。
+ * 达到数量上限立即停止整棵遍历；跳过 symlink（防循环）与无法读取的目录。
+ */
+export async function findGitDirs(root: string): Promise<string[]> {
+  const found: string[] = [];
+  const walk = async (dir: string, depth: number): Promise<void> => {
+    if (depth > MAX_GIT_SCAN_DEPTH) return;
+    let entries: Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (found.length >= MAX_GIT_DIRS) throw new ScanLimitError();
+      if (entry.name === ".git" && entry.isDirectory()) {
+        found.push(join(dir, ".git"));
+        continue;
+      }
+      if (!entry.isDirectory() || GIT_DIR_SCAN_SKIP.has(entry.name)) continue;
+      await walk(join(dir, entry.name), depth + 1);
+    }
+  };
+  try {
+    await walk(root, 0);
+  } catch (error) {
+    if (!(error instanceof ScanLimitError)) throw error;
+  }
+  return found;
+}
+
+export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Promise<string[]> {
   const args = ["--new-session", "--die-with-parent", "--unshare-user", "--unshare-pid"];
+  // --*-bind-try：配置的路径不存在时忽略该项而不是让整条命令失败
   for (const path of resolved.writablePaths) {
     const absolutePath = resolveBwrapPath(path, cwd);
-    args.push("--bind", absolutePath, absolutePath);
+    args.push("--bind-try", absolutePath, absolutePath);
   }
   for (const path of resolved.extraWritablePaths) {
     const absolutePath = resolveBwrapPath(path, cwd);
-    args.push("--bind", absolutePath, absolutePath);
+    args.push("--bind-try", absolutePath, absolutePath);
   }
   for (const path of resolved.tmpfsPaths) {
     args.push("--tmpfs", resolveBwrapPath(path, cwd));
   }
   if (!resolved.network) args.push("--unshare-net");
+  // --ro-bind-try：目录不存在（或已被删除）时自动忽略
   for (const name of PROTECTED_DIRS) {
     const absolutePath = join(cwd, name);
-    if (existsSync(absolutePath)) args.push("--ro-bind", absolutePath, absolutePath);
+    args.push("--ro-bind-try", absolutePath, absolutePath);
+  }
+  // 工作区下所有 .git 一律只读：可写 bind 之上的覆盖绑定，防止命令篡改仓库元数据。
+  // 根目录本身是 git 仓库时只保护根 .git（递归扫描有成本，绝大多数情况根即唯一仓库）；
+  // 根不是 git 仓库时才递归扫描嵌套仓库（如 monorepo 子仓库）。
+  const rootGit = join(cwd, ".git");
+  let gitDirs: string[];
+  try {
+    await stat(rootGit);
+    gitDirs = [rootGit];
+  } catch {
+    gitDirs = await findGitDirs(cwd);
+  }
+  for (const gitDir of gitDirs) {
+    args.push("--ro-bind-try", gitDir, gitDir);
   }
   args.push(...resolved.extraArgs);
   return args;
@@ -265,7 +338,7 @@ export function createBwrapBashOperations(
         "--ro-bind",
         "/",
         "/",
-        ...buildBwrapArgs(resolved, workspace),
+        ...(await buildBwrapArgs(resolved, workspace)),
         "--dev",
         "/dev",
         "--proc",

package/src/bwrap/runtime.ts

@@ -1,6 +1,6 @@
 import { randomUUID } from "node:crypto";
 import { createWriteStream, existsSync, mkdirSync, readFileSync, type WriteStream } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { mkdir, unlink, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
 import {
@@ -141,7 +141,7 @@ function countNewlines(data: Buffer): number {
 
 /**
  * 合并 stdout/stderr 的流式输出累积器：输出在运行时就直接写入
- * agent-dir/tmp/{uuid}.txt（完整内容），内存只保留尾部缓冲。
+ * agent-dir/tmp/{sessionId}/{uuid}.txt（完整内容），内存只保留尾部缓冲。
  * 大输出不会撑爆内存；最终结果只返回截断后的文本。
  */
 class BashOutput {
@@ -151,13 +151,18 @@ class BashOutput {
   private tailBytes = 0;
   private totalBytes = 0;
   private totalLines = 0;
+  private readonly sessionId: string;
   filePath: string | undefined;
 
+  constructor(sessionId: string) {
+    this.sessionId = sessionId;
+  }
+
   append(data: Buffer): void {
     this.totalBytes += data.length;
     this.totalLines += countNewlines(data);
     if (!this.stream) {
-      const dir = join(getAgentDir(), "tmp");
+      const dir = join(getAgentDir(), "tmp", this.sessionId);
       mkdirSync(dir, { recursive: true });
       this.filePath = join(dir, `${randomUUID()}.txt`);
       this.stream = createWriteStream(this.filePath, { flags: "w" });
@@ -361,7 +366,7 @@ export class BwrapRuntime {
       isWindows || needsApproval || !runtime.bwrapEnabled
         ? createLocalBashOperations()
         : createBwrapBashOperations(runtime, workspace);
-    const output = new BashOutput();
+    const output = new BashOutput(request.ctx.sessionManager.getSessionId());
     const { onUpdate } = request;
 
     // 流式进度：节流推送尾部快照（对齐 pi 内置 bash 的实时输出体验）
@@ -406,6 +411,16 @@ export class BwrapRuntime {
       });
       await output.close();
       const truncation = truncateTail(output.tailText());
+      // 未截断：完整输出已直接返回给模型，临时文件没有用途，删掉避免
+      // agent-dir/tmp 堆积无主文件（删除失败只残留文件，不影响命令结果）
+      if (!truncation.truncated && output.filePath) {
+        try {
+          await unlink(output.filePath);
+        } catch {
+          // 删除失败（如沙箱只读）：best-effort，命令结果不受影响
+        }
+        output.filePath = undefined;
+      }
       return {
         exitCode,
         output: truncation.content,