@trim21/personal-pi-extensions 0.0.427 → 0.0.429

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.427",
+  "version": "0.0.429",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -1,8 +1,7 @@
 import { type ChildProcess, spawn } from "node:child_process";
-import { closeSync, constants, type Dirent, existsSync, openSync, readFileSync } from "node:fs";
+import { constants, type Dirent, existsSync, readFileSync } from "node:fs";
 import { access as fsAccess, readdir, stat } from "node:fs/promises";
 import { delimiter, join } from "node:path";
-import { fileURLToPath } from "node:url";
 
 import { StringEnum } from "@earendil-works/pi-ai";
 import { type BashOperations, getAgentDir, getShellConfig } from "@earendil-works/pi-coding-agent";
@@ -362,22 +361,6 @@ export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Prom
   return args;
 }
 
-const SECCOMP_BPF_FILE = (() => {
-  const directory = fileURLToPath(new URL(".", import.meta.url));
-  if (process.arch === "x64") return join(directory, "seccomp-x86_64.bpf");
-  if (process.arch === "arm64") return join(directory, "seccomp-aarch64.bpf");
-  return "";
-})();
-
-function getSeccompFd(): number | undefined {
-  if (!SECCOMP_BPF_FILE) return undefined;
-  try {
-    return openSync(SECCOMP_BPF_FILE, "r");
-  } catch {
-    return undefined;
-  }
-}
-
 function killChild(child: ChildProcess): void {
   if (!child.pid) return;
   try {
@@ -460,19 +443,13 @@ export function createBwrapBashOperations(
         });
       }
 
-      const seccompFd = resolved.network ? undefined : getSeccompFd();
       const child = spawn(
         findBwrap(resolved.bwrapPath),
-        seccompFd === undefined
-          ? [...baseArgs, "--", shell, "-lc", command]
-          : [...baseArgs, "--seccomp", "3", "--", shell, "-lc", command],
+        [...baseArgs, "--", shell, "-lc", command],
         {
           cwd,
           detached: true,
-          stdio:
-            seccompFd === undefined
-              ? ["ignore", "pipe", "pipe"]
-              : ["ignore", "pipe", "pipe", seccompFd],
+          stdio: ["ignore", "pipe", "pipe"],
           env,
         },
       );
@@ -493,7 +470,6 @@ export function createBwrapBashOperations(
         child.once("close", (exitCode) => {
           if (timeoutHandle) clearTimeout(timeoutHandle);
           signal?.removeEventListener("abort", onAbort);
-          if (seccompFd !== undefined) closeSync(seccompFd);
           if (signal?.aborted) reject(new Error("aborted"));
           else if (timedOut) reject(new Error(`timeout:${timeout}`));
           else resolve({ exitCode });

package/src/bwrap/holder.js

@@ -1,11 +1,9 @@
 import { spawn } from "node:child_process";
-import { open, readFile, writeFile } from "node:fs/promises";
 import { setTimeout as sleep } from "node:timers/promises";
 const args = process.argv.slice(2);
 const configPath = args[0];
 const singBoxPath = args[1];
-const readyFile = args[2];
-if (!configPath || !singBoxPath || !readyFile) {
+if (!configPath || !singBoxPath) {
   process.exit(2);
 }
 function tap0Exists() {
@@ -24,11 +22,9 @@ async function waitFor(attempts, delayMs, predicate) {
 }
 async function main() {
   await waitFor(100, 100, tap0Exists);
-  const logPath = `${configPath}.log`;
-  const logFd = await open(logPath, "w");
   const singbox = spawn(singBoxPath, ["run", "-c", configPath], {
     env: { ...process.env, ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER: "true" },
-    stdio: ["ignore", logFd.fd, logFd.fd]
+    stdio: ["ignore", "inherit", "inherit"]
   });
   const stop = () => {
     singbox.kill("SIGTERM");
@@ -41,15 +37,6 @@ async function main() {
     stop();
     process.exit(0);
   });
-  await waitFor(200, 100, async () => {
-    try {
-      const log = await readFile(logPath, "utf8");
-      return log.includes("sing-box started");
-    } catch {
-      return false;
-    }
-  });
-  await writeFile(readyFile, "");
   await new Promise((resolve) => singbox.once("exit", () => resolve()));
 }
 try {

package/src/bwrap/holder.ts

@@ -1,14 +1,12 @@
 /* eslint-disable no-console, unicorn/no-process-exit -- 独立 CLI 脚本，由 unshare 直接执行 */
 import { spawn } from "node:child_process";
-import { open, readFile, writeFile } from "node:fs/promises";
 import { setTimeout as sleep } from "node:timers/promises";
 
-// 用法：unshare -Urn node holder.ts <config> <singbox> <ready-file>
+// 用法：unshare -Urn node holder.ts <config> <singbox>
 const args = process.argv.slice(2);
 const configPath = args[0];
 const singBoxPath = args[1];
-const readyFile = args[2];
-if (!configPath || !singBoxPath || !readyFile) {
+if (!configPath || !singBoxPath) {
   process.exit(2);
 }
 
@@ -36,11 +34,10 @@ async function main(): Promise<void> {
   // slirp4netns 由宿主侧 spawn，这里等它建好 tap0
   await waitFor(100, 100, tap0Exists);
 
-  const logPath = `${configPath}.log`;
-  const logFd = await open(logPath, "w");
+  // sing-box 日志透传到 holder 的 stdout/stderr，宿主侧监听 "sing-box started" 判定就绪
   const singbox = spawn(singBoxPath, ["run", "-c", configPath], {
     env: { ...process.env, ENABLE_DEPRECATED_MISSING_DOMAIN_RESOLVER: "true" },
-    stdio: ["ignore", logFd.fd, logFd.fd],
+    stdio: ["ignore", "inherit", "inherit"],
   });
 
   const stop = (): void => {
@@ -55,17 +52,6 @@ async function main(): Promise<void> {
     process.exit(0);
   });
 
-  // 以 "sing-box started" 日志作为就绪标志（TUN 与 gvisor 数据面此时已可用）
-  await waitFor(200, 100, async () => {
-    try {
-      const log = await readFile(logPath, "utf8");
-      return log.includes("sing-box started");
-    } catch {
-      return false;
-    }
-  });
-  await writeFile(readyFile, "");
-
   await new Promise<void>((resolve) => singbox.once("exit", () => resolve()));
 }
 

package/src/bwrap/network-stack.ts

@@ -1,5 +1,5 @@
-import { spawn } from "node:child_process";
-import { access, mkdtemp, readFile, readlink, rm, writeFile } from "node:fs/promises";
+import { type ChildProcess, spawn } from "node:child_process";
+import { mkdtemp, readFile, readlink, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -72,17 +72,32 @@ async function waitForNewUserns(pid: number, timeoutMs = 5000): Promise<void> {
   throw new Error("Timed out waiting for sandbox network namespace");
 }
 
-async function waitForFile(path: string, timeoutMs = 15000): Promise<void> {
-  const deadline = Date.now() + timeoutMs;
-  while (Date.now() < deadline) {
-    try {
-      await access(path);
-      return;
-    } catch {
-      await new Promise((resolve) => setTimeout(resolve, 100));
-    }
-  }
-  throw new Error("Timed out waiting for sandbox network stack to become ready");
+/** 监听 holder 的 stdout/stderr（sing-box 日志透传），以 "sing-box started" 作为就绪标志。 */
+function waitForSingboxStarted(holder: ChildProcess, timeoutMs = 20000): Promise<void> {
+  return new Promise((resolve, reject) => {
+    let settled = false;
+    const timer = setTimeout(() => {
+      if (settled) return;
+      settled = true;
+      reject(new Error("Timed out waiting for sing-box to start"));
+    }, timeoutMs);
+    const onData = (data: Buffer): void => {
+      if (settled) return;
+      if (data.toString().includes("sing-box started")) {
+        settled = true;
+        clearTimeout(timer);
+        resolve();
+      }
+    };
+    holder.stdout?.on("data", onData);
+    holder.stderr?.on("data", onData);
+    holder.once("exit", (code) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      reject(new Error(`Sandbox holder exited before sing-box started (code ${code})`));
+    });
+  });
 }
 
 function killChild(pid: number | undefined): void {
@@ -125,20 +140,16 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
   const { allowlist, dnsServers, singBoxPath, slirp4netnsPath } = options;
   const directory = await mkdtemp(join(tmpdir(), "pi-netns-"));
   const configPath = join(directory, "singbox.json");
-  const readyFile = join(directory, "ready");
   await writeFile(configPath, generateSingboxConfig({ allowlist, dnsServers }));
 
-  const holder = spawn(
-    "unshare",
-    ["-Urn", "--", "node", HOLDER_PATH, configPath, singBoxPath, readyFile],
-    {
-      env: {
-        HOME: process.env.HOME ?? "",
-        PATH: `${process.env.PATH ?? ""}:${SBIN_PATH_SUFFIX}`,
-      },
-      stdio: "ignore",
+  const holder = spawn("unshare", ["-Urn", "--", "node", HOLDER_PATH, configPath, singBoxPath], {
+    env: {
+      HOME: process.env.HOME ?? "",
+      PATH: `${process.env.PATH ?? ""}:${SBIN_PATH_SUFFIX}`,
     },
-  );
+    // sing-box 日志经 holder 透传到这里的 stdout/stderr，用于判定就绪
+    stdio: ["ignore", "pipe", "pipe"],
+  });
   if (holder.pid === undefined) {
     throw new Error("Failed to start network namespace holder");
   }
@@ -157,7 +168,7 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
     { stdio: "ignore" },
   );
   const slirpPid = slirp.pid;
-  await waitForFile(readyFile);
+  await waitForSingboxStarted(holder);
 
   const state: NetworkStackState = { holderPid, slirpPid, directory };
   const stack: NetworkStack = {

package/src/claude-code/files.ts

@@ -17,6 +17,7 @@ import { Type } from "typebox";
 import { appendLspDiagnosticText } from "../lib/lsp/diagnostic.js";
 import { type LspService, registerLsp } from "../lib/lsp/lsp.js";
 import { formatSubtitlePath } from "../lib/path.js";
+import type { ToolPendant } from "../lib/pendant.ts";
 import { guardWriteAccess } from "../lib/write-guard.js";
 import {
   type ClaudeCodeState,
@@ -302,7 +303,10 @@ export function registerFileTools(
           content,
           details: {
             reads: { [key]: snapshot },
-            pendant: { subtitle: formatSubtitlePath(ctx.cwd, filePath) },
+            pendant: {
+              subtitle: formatSubtitlePath(ctx.cwd, filePath),
+              title: "Read",
+            } satisfies ToolPendant,
           },
         };
       }
@@ -354,7 +358,10 @@ export function registerFileTools(
         content: [{ type: "text", text: formatted.text }],
         details: {
           reads: { [key]: snapshot },
-          pendant: { subtitle: formatSubtitlePath(ctx.cwd, filePath) },
+          pendant: {
+            subtitle: formatSubtitlePath(ctx.cwd, filePath),
+            title: "Read",
+          } satisfies ToolPendant,
         },
       };
     },
@@ -566,7 +573,10 @@ export function registerFileTools(
         content: [{ type: "text" as const, text }],
         details: {
           ...details,
-          pendant: { subtitle: formatSubtitlePath(ctx.cwd, filePath, errorCount, warningCount) },
+          pendant: {
+            subtitle: formatSubtitlePath(ctx.cwd, filePath, errorCount, warningCount),
+            title: "Edit",
+          } satisfies ToolPendant,
         },
       };
     },