@trim21/personal-pi-extensions 0.0.429 → 0.0.430

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.429",
+  "version": "0.0.430",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/core.ts

@@ -370,7 +370,7 @@ function killChild(child: ChildProcess): void {
   }
 }
 
-/** 为 net-allowlist 模式创建常驻网络栈；非该模式返回 undefined。 */
+/** 为 net-allowlist 模式创建网络栈；非该模式返回 undefined。每次命令现建现停。 */
 export async function createNetworkStack(
   resolved: ResolvedBwrap,
 ): Promise<NetworkStack | undefined> {

package/src/bwrap/network-stack.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { generateSingboxConfig } from "./singbox-config.js";
 
 export interface NetworkStackOptions {
-  /** 允许直连的域名 / IP:port 列表（session 启动时固定，reload 才会重新加载）。 */
+  /** 允许直连的域名 / IP:port 列表（每次命令从配置重新读取）。 */
   readonly allowlist: readonly string[];
   /** 真实 DNS 服务器列表，按顺序 fallback。 */
   readonly dnsServers: readonly string[];
@@ -132,7 +132,7 @@ const stackFinalizer = new FinalizationRegistry<NetworkStackState>((state) => {
 });
 
 /**
- * 启动常驻的 per-session 网络栈：holder 进程持有 netns（内部跑 sing-box 的
+ * 启动网络栈：holder 进程持有 netns（内部跑 sing-box 的
  * TUN + fakeip + deny-by-default），slirp4netns 提供 egress。返回前
  * netns/sing-box/slirp4netns 均已就绪，命令通过 nsenter 进入该 netns 执行。
  */

package/src/bwrap/runtime.ts

@@ -38,7 +38,6 @@ import {
   resolveHeadlessBwrap,
 } from "./core.js";
 import { dcgSuggestion } from "./dcg-scan.js";
-import { type NetworkStack } from "./network-stack.js";
 
 export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: string };
 
@@ -197,6 +196,11 @@ class BashOutput {
     });
   }
 
+  // eslint-disable-next-line unicorn/no-nonstandard-builtin-properties -- ES2024 标准（Node 24 原生支持）
+  async [Symbol.asyncDispose](): Promise<void> {
+    await this.close();
+  }
+
   /** 尾部文本（截断结果的候选，未截断时即完整输出）。 */
   tailText(): string {
     return Buffer.concat(this.tail, this.tailBytes).toString("utf8");
@@ -242,7 +246,6 @@ export class BwrapRuntime {
   private resolved: ResolvedBwrap | undefined;
   private sandboxDisabled = false;
   private bwrapUnavailable = false;
-  private networkStack: NetworkStack | undefined;
 
   setup(pi: ExtensionAPI): void {
     pi.registerFlag("no-bwrap", {
@@ -315,8 +318,6 @@ export class BwrapRuntime {
   setMode(cwd: string, mode: BwrapMode): ResolvedBwrap {
     this.resolved = resolveBwrap({ ...loadBwrapConfig(cwd), mode });
     this.sandboxDisabled = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
     return this.resolved;
   }
 
@@ -324,8 +325,6 @@ export class BwrapRuntime {
     this.resolved = undefined;
     this.sandboxDisabled = false;
     this.bwrapUnavailable = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
   }
 
   async execute(request: BwrapExecutionRequest): Promise<BwrapExecutionResult> {
@@ -361,11 +360,23 @@ export class BwrapRuntime {
         await this.approveFullAccess(request.ctx, request.command, request.description, execCwd);
       }
     }
-    const operations =
-      isWindows || needsApproval || !runtime.bwrapEnabled
-        ? createLocalBashOperations()
-        : createBwrapBashOperations(runtime, workspace, await this.getNetworkStack(runtime));
-    const output = new BashOutput(request.ctx.sessionManager.getSessionId());
+    const local = isWindows || needsApproval || !runtime.bwrapEnabled;
+    // 每次命令现建网络栈（启动约 140ms），作用域结束自动停栈；allowlist 变化即时生效
+    const networkStack = local ? undefined : await createNetworkStack(runtime);
+    await using _stack = {
+      // eslint-disable-next-line unicorn/no-nonstandard-builtin-properties -- ES2024 标准（Node 24 原生支持）
+      async [Symbol.asyncDispose]() {
+        try {
+          await networkStack?.stop();
+        } catch {
+          // best-effort：停栈失败（进程已退出/目录删除失败）不掩盖命令结果
+        }
+      },
+    };
+    const operations = local
+      ? createLocalBashOperations()
+      : createBwrapBashOperations(runtime, workspace, networkStack);
+    await using output = new BashOutput(request.ctx.sessionManager.getSessionId());
     const { onUpdate } = request;
 
     // 流式进度：节流推送尾部快照（对齐 pi 内置 bash 的实时输出体验）
@@ -442,7 +453,6 @@ export class BwrapRuntime {
     } finally {
       if (updateTimer) clearTimeout(updateTimer);
       if (onUpdate && dirty) emitUpdate();
-      await output.close();
     }
   }
 
@@ -454,21 +464,6 @@ export class BwrapRuntime {
     return this.resolved;
   }
 
-  /** net-allowlist 模式的常驻网络栈：惰性创建，session 期间复用（allowlist 固定）。 */
-  private async getNetworkStack(runtime: ResolvedBwrap): Promise<NetworkStack | undefined> {
-    if (runtime.mode !== "net-allowlist" || runtime.networkAllowlist.length === 0) {
-      if (this.networkStack) {
-        void this.networkStack.stop();
-        this.networkStack = undefined;
-      }
-      return undefined;
-    }
-    if (!this.networkStack) {
-      this.networkStack = await createNetworkStack(runtime);
-    }
-    return this.networkStack;
-  }
-
   private async approveFullAccess(
     ctx: ExtensionContext,
     command: string,
@@ -744,8 +739,6 @@ export class BwrapRuntime {
   private reload(ctx: ExtensionCommandContext): void {
     this.resolved = undefined;
     this.bwrapUnavailable = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
     const runtime = this.resolve(ctx);
     ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
     ctx.ui.notify(`bwrap config reloaded (mode: ${runtime.mode})`, "info");