@trim21/personal-pi-extensions 0.0.399 → 0.0.401

package/README.md

@@ -52,7 +52,9 @@ bash 工具（opencode 风格 `bash`、Claude Code 风格 `Bash`）注册了 `da
 
 ### 保护目录
 
-`.git`、`.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读。
+`.pi`、`.agent` 即使在 `workspace-write` 模式下也始终只读；`.git` 同样只读：工作区根是 git 仓库时保护根 `.git`，根不是 git 仓库时才递归扫描嵌套仓库（monorepo 子仓库，跳过 `node_modules`、`.venv` 等包目录）。
+
+可写与保护路径均使用 bwrap 的 `--*-bind-try` 变体：路径不存在时自动忽略该项，而不是让整条命令失败。
 
 ### 运行时命令
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.399",
+  "version": "0.0.401",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -1,6 +1,6 @@
 import { type ChildProcess, spawn } from "node:child_process";
-import { closeSync, constants, existsSync, openSync, readFileSync } from "node:fs";
-import { access as fsAccess } from "node:fs/promises";
+import { closeSync, constants, type Dirent, existsSync, openSync, readFileSync } from "node:fs";
+import { access as fsAccess, readdir, stat } from "node:fs/promises";
 import { delimiter, join } from "node:path";
 import { fileURLToPath } from "node:url";
 
@@ -12,7 +12,7 @@ import { Value } from "typebox/value";
 import { expandHome } from "../lib/path.js";
 import { type ApprovalRule } from "./approval-rules.js";
 
-const PROTECTED_DIRS = [".git", ".pi", ".agent"];
+const PROTECTED_DIRS = [".pi", ".agent"];
 
 export const BWRAP_MODES = ["allow-all", "workspace-write", "allow-net", "readonly"] as const;
 
@@ -190,23 +190,96 @@ export function findBwrap(override?: string): string {
   return findDefaultBwrap();
 }
 
-export function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): string[] {
+/** 扫描 .git 时跳过的目录：包/依赖/构建产物，嵌套 git 仓库几乎不会出现在这里。 */
+const GIT_DIR_SCAN_SKIP = new Set([
+  "node_modules",
+  ".venv",
+  "venv",
+  ".venvs",
+  "dist",
+  "build",
+  "target",
+  "__pycache__",
+  ".next",
+  ".cache",
+  ".turbo",
+  ".pytest_cache",
+  ".mypy_cache",
+  ".hg",
+  ".svn",
+]);
+
+/** 最多收集的 .git 数量与扫描深度，防止异常大的工作区拖慢每条命令。 */
+const MAX_GIT_DIRS = 64;
+const MAX_GIT_SCAN_DEPTH = 24;
+
+class ScanLimitError extends Error {}
+
+/**
+ * 递归扫描工作区，收集所有 `.git` 目录的绝对路径（monorepo / 嵌套仓库）。
+ * 达到数量上限立即停止整棵遍历；跳过 symlink（防循环）与无法读取的目录。
+ */
+export async function findGitDirs(root: string): Promise<string[]> {
+  const found: string[] = [];
+  const walk = async (dir: string, depth: number): Promise<void> => {
+    if (depth > MAX_GIT_SCAN_DEPTH) return;
+    let entries: Dirent[];
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (found.length >= MAX_GIT_DIRS) throw new ScanLimitError();
+      if (entry.name === ".git" && entry.isDirectory()) {
+        found.push(join(dir, ".git"));
+        continue;
+      }
+      if (!entry.isDirectory() || GIT_DIR_SCAN_SKIP.has(entry.name)) continue;
+      await walk(join(dir, entry.name), depth + 1);
+    }
+  };
+  try {
+    await walk(root, 0);
+  } catch (error) {
+    if (!(error instanceof ScanLimitError)) throw error;
+  }
+  return found;
+}
+
+export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Promise<string[]> {
   const args = ["--new-session", "--die-with-parent", "--unshare-user", "--unshare-pid"];
+  // --*-bind-try：配置的路径不存在时忽略该项而不是让整条命令失败
   for (const path of resolved.writablePaths) {
     const absolutePath = resolveBwrapPath(path, cwd);
-    args.push("--bind", absolutePath, absolutePath);
+    args.push("--bind-try", absolutePath, absolutePath);
   }
   for (const path of resolved.extraWritablePaths) {
     const absolutePath = resolveBwrapPath(path, cwd);
-    args.push("--bind", absolutePath, absolutePath);
+    args.push("--bind-try", absolutePath, absolutePath);
   }
   for (const path of resolved.tmpfsPaths) {
     args.push("--tmpfs", resolveBwrapPath(path, cwd));
   }
   if (!resolved.network) args.push("--unshare-net");
+  // --ro-bind-try：目录不存在（或已被删除）时自动忽略
   for (const name of PROTECTED_DIRS) {
     const absolutePath = join(cwd, name);
-    if (existsSync(absolutePath)) args.push("--ro-bind", absolutePath, absolutePath);
+    args.push("--ro-bind-try", absolutePath, absolutePath);
+  }
+  // 工作区下所有 .git 一律只读：可写 bind 之上的覆盖绑定，防止命令篡改仓库元数据。
+  // 根目录本身是 git 仓库时只保护根 .git（递归扫描有成本，绝大多数情况根即唯一仓库）；
+  // 根不是 git 仓库时才递归扫描嵌套仓库（如 monorepo 子仓库）。
+  const rootGit = join(cwd, ".git");
+  let gitDirs: string[];
+  try {
+    await stat(rootGit);
+    gitDirs = [rootGit];
+  } catch {
+    gitDirs = await findGitDirs(cwd);
+  }
+  for (const gitDir of gitDirs) {
+    args.push("--ro-bind-try", gitDir, gitDir);
   }
   args.push(...resolved.extraArgs);
   return args;
@@ -265,7 +338,7 @@ export function createBwrapBashOperations(
         "--ro-bind",
         "/",
         "/",
-        ...buildBwrapArgs(resolved, workspace),
+        ...(await buildBwrapArgs(resolved, workspace)),
         "--dev",
         "/dev",
         "--proc",

package/src/claude-code/bash.md

@@ -6,6 +6,8 @@ The working directory persists between commands, but shell state does not. The s
 
 Commands run in a sandbox: no write access outside the workspace and no network access. Use the `dangerouslyDisableSandbox` parameter to request unsandboxed execution; the user must approve this request.
 
+Long command output is automatically truncated and the full output is saved to a file. Avoid piping commands through `tail` to limit output unless you have a specific reason.
+
 IMPORTANT: Avoid using this tool to run `find`, `grep`, `cat`, `head`, `tail`, `sed`, `awk`, or `echo` commands, unless explicitly instructed or after you have verified that a dedicated tool cannot accomplish your task. Instead, use the appropriate dedicated tool as this will provide a much better experience for the user:
 
 - File search: Use Glob (NOT find or ls)

package/src/opencode/bash.md

@@ -0,0 +1,7 @@
+### Bash tool
+
+Executes a given bash command synchronously and returns its output.
+
+Commands run in a sandbox: no write access outside the workspace and no network access. Use the `dangerouslyDisableSandbox` parameter to request unsandboxed execution; the user must approve this request.
+
+Long command output is automatically truncated and the full output is saved to a file. Avoid piping commands through `tail` to limit output unless you have a specific reason.

package/src/opencode/bash.ts

@@ -1,3 +1,6 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
 import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 
@@ -10,6 +13,9 @@ const MAX_TIMEOUT_MS = 600_000;
 /** 对齐上游 opencode 的截断提示文案（tools/BashTool/bash.ts）。 */
 const CAPTURE_TRUNCATED_NOTICE = "[output capture truncated at the in-memory safety limit]";
 
+/** Bash tool guidance, kept in markdown so it reads like documentation. */
+const BASH_PROMPT = readFileSync(fileURLToPath(new URL("bash.md", import.meta.url)), "utf8").trim();
+
 /**
  * 对齐上游 opencode（packages/core/src/tool/bash.ts）：
  * 命令失败（非 0 退出码）与超时都不抛错，输出与状态文本一起返回，
@@ -32,6 +38,7 @@ export default function opencodeBash(
       "Every command runs in the foreground. Background command execution is not supported; shell jobs are waited for before the tool returns.",
     ].join("\n"),
     promptSnippet: "execute bash command",
+    promptGuidelines: [BASH_PROMPT],
     parameters: Type.Object(
       {
         command: Type.String({ description: "The command to execute" }),