@trim21/personal-pi-extensions 0.0.429 → 0.0.431

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.0.429",
+  "version": "0.0.431",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [
@@ -37,6 +37,7 @@
     "@earendil-works/pi-ai": "^0.84.1",
     "@earendil-works/pi-coding-agent": "^0.84.1",
     "@eslint/js": "10.0.1",
+    "@types/lodash-es": "^4.17.12",
     "@types/node": "^24.13.3",
     "@types/turndown": "^5.0.6",
     "@typescript/native": "npm:typescript@^7.0.2",
@@ -94,6 +95,7 @@
     "@vscode/tree-sitter-wasm": "^0.3.1",
     "jsonc-parser": "^3.3.1",
     "linkedom": "^0.18.0",
+    "lodash-es": "^4.18.1",
     "minimatch": "^10.2.6",
     "turndown": "^7.2.0",
     "vscode-jsonrpc": "^9.0.1",

package/src/bwrap/core.ts

@@ -370,7 +370,7 @@ function killChild(child: ChildProcess): void {
   }
 }
 
-/** 为 net-allowlist 模式创建常驻网络栈；非该模式返回 undefined。 */
+/** 为 net-allowlist 模式创建网络栈；非该模式返回 undefined。每次命令现建现停。 */
 export async function createNetworkStack(
   resolved: ResolvedBwrap,
 ): Promise<NetworkStack | undefined> {

package/src/bwrap/network-stack.ts

@@ -7,7 +7,7 @@ import { fileURLToPath } from "node:url";
 import { generateSingboxConfig } from "./singbox-config.js";
 
 export interface NetworkStackOptions {
-  /** 允许直连的域名 / IP:port 列表（session 启动时固定，reload 才会重新加载）。 */
+  /** 允许直连的域名 / IP:port 列表（每次命令从配置重新读取）。 */
   readonly allowlist: readonly string[];
   /** 真实 DNS 服务器列表，按顺序 fallback。 */
   readonly dnsServers: readonly string[];
@@ -132,7 +132,7 @@ const stackFinalizer = new FinalizationRegistry<NetworkStackState>((state) => {
 });
 
 /**
- * 启动常驻的 per-session 网络栈：holder 进程持有 netns（内部跑 sing-box 的
+ * 启动网络栈：holder 进程持有 netns（内部跑 sing-box 的
  * TUN + fakeip + deny-by-default），slirp4netns 提供 egress。返回前
  * netns/sing-box/slirp4netns 均已就绪，命令通过 nsenter 进入该 netns 执行。
  */

package/src/bwrap/runtime.ts

@@ -13,6 +13,7 @@ import {
   truncateTail,
   type TruncationResult,
 } from "@earendil-works/pi-coding-agent";
+import { throttle } from "lodash-es";
 import { type TObject, Type } from "typebox";
 
 import { type CommandSpec, parseCommand } from "../lib/cli.js";
@@ -38,7 +39,6 @@ import {
   resolveHeadlessBwrap,
 } from "./core.js";
 import { dcgSuggestion } from "./dcg-scan.js";
-import { type NetworkStack } from "./network-stack.js";
 
 export type EscalationDecision = { kind: "dialog" } | { kind: "deny"; reason: string };
 
@@ -197,6 +197,11 @@ class BashOutput {
     });
   }
 
+  // eslint-disable-next-line unicorn/no-nonstandard-builtin-properties -- ES2024 标准（Node 24 原生支持）
+  async [Symbol.asyncDispose](): Promise<void> {
+    await this.close();
+  }
+
   /** 尾部文本（截断结果的候选，未截断时即完整输出）。 */
   tailText(): string {
     return Buffer.concat(this.tail, this.tailBytes).toString("utf8");
@@ -242,7 +247,6 @@ export class BwrapRuntime {
   private resolved: ResolvedBwrap | undefined;
   private sandboxDisabled = false;
   private bwrapUnavailable = false;
-  private networkStack: NetworkStack | undefined;
 
   setup(pi: ExtensionAPI): void {
     pi.registerFlag("no-bwrap", {
@@ -315,8 +319,6 @@ export class BwrapRuntime {
   setMode(cwd: string, mode: BwrapMode): ResolvedBwrap {
     this.resolved = resolveBwrap({ ...loadBwrapConfig(cwd), mode });
     this.sandboxDisabled = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
     return this.resolved;
   }
 
@@ -324,8 +326,6 @@ export class BwrapRuntime {
     this.resolved = undefined;
     this.sandboxDisabled = false;
     this.bwrapUnavailable = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
   }
 
   async execute(request: BwrapExecutionRequest): Promise<BwrapExecutionResult> {
@@ -361,49 +361,43 @@ export class BwrapRuntime {
         await this.approveFullAccess(request.ctx, request.command, request.description, execCwd);
       }
     }
-    const operations =
-      isWindows || needsApproval || !runtime.bwrapEnabled
-        ? createLocalBashOperations()
-        : createBwrapBashOperations(runtime, workspace, await this.getNetworkStack(runtime));
-    const output = new BashOutput(request.ctx.sessionManager.getSessionId());
+    const local = isWindows || needsApproval || !runtime.bwrapEnabled;
+    // 每次命令现建网络栈（启动约 140ms），作用域结束自动停栈；allowlist 变化即时生效
+    const networkStack = local ? undefined : await createNetworkStack(runtime);
+    await using _stack = {
+      // eslint-disable-next-line unicorn/no-nonstandard-builtin-properties -- ES2024 标准（Node 24 原生支持）
+      async [Symbol.asyncDispose]() {
+        try {
+          await networkStack?.stop();
+        } catch {
+          // best-effort：停栈失败（进程已退出/目录删除失败）不掩盖命令结果
+        }
+      },
+    };
+    const operations = local
+      ? createLocalBashOperations()
+      : createBwrapBashOperations(runtime, workspace, networkStack);
+    await using output = new BashOutput(request.ctx.sessionManager.getSessionId());
     const { onUpdate } = request;
 
-    // 流式进度：节流推送尾部快照（对齐 pi 内置 bash 的实时输出体验）
-    let updateTimer: ReturnType<typeof setTimeout> | undefined;
-    let dirty = false;
-    let lastUpdateAt = 0;
-    const emitUpdate = () => {
-      if (!onUpdate || !dirty) return;
-      dirty = false;
-      lastUpdateAt = Date.now();
-      onUpdate({
-        content: [{ type: "text", text: output.tailSnapshot() }],
-        details: undefined,
-      });
-    };
-    const scheduleUpdate = () => {
-      if (!onUpdate) return;
-      dirty = true;
-      const delay = BASH_UPDATE_THROTTLE_MS - (Date.now() - lastUpdateAt);
-      if (delay <= 0) {
-        if (updateTimer) clearTimeout(updateTimer);
-        updateTimer = undefined;
-        emitUpdate();
-        return;
-      }
-      if (updateTimer) return;
-      updateTimer = setTimeout(() => {
-        updateTimer = undefined;
-        emitUpdate();
-      }, delay);
-    };
+    // 流式进度：限流推送尾部快照（对齐 pi 内置 bash 的实时输出体验）
+    const emitUpdate = throttle(
+      () => {
+        onUpdate?.({
+          content: [{ type: "text", text: output.tailSnapshot() }],
+          details: undefined,
+        });
+      },
+      BASH_UPDATE_THROTTLE_MS,
+      { trailing: true },
+    );
 
     try {
       if (onUpdate) onUpdate({ content: [], details: undefined });
       const { exitCode } = await operations.exec(request.command, execCwd, {
         onData: (data) => {
           output.append(data);
-          scheduleUpdate();
+          emitUpdate();
         },
         signal: request.signal,
         timeout: request.timeout,
@@ -440,9 +434,8 @@ export class BwrapRuntime {
       }
       throw error;
     } finally {
-      if (updateTimer) clearTimeout(updateTimer);
-      if (onUpdate && dirty) emitUpdate();
-      await output.close();
+      emitUpdate.flush();
+      emitUpdate.cancel();
     }
   }
 
@@ -454,21 +447,6 @@ export class BwrapRuntime {
     return this.resolved;
   }
 
-  /** net-allowlist 模式的常驻网络栈：惰性创建，session 期间复用（allowlist 固定）。 */
-  private async getNetworkStack(runtime: ResolvedBwrap): Promise<NetworkStack | undefined> {
-    if (runtime.mode !== "net-allowlist" || runtime.networkAllowlist.length === 0) {
-      if (this.networkStack) {
-        void this.networkStack.stop();
-        this.networkStack = undefined;
-      }
-      return undefined;
-    }
-    if (!this.networkStack) {
-      this.networkStack = await createNetworkStack(runtime);
-    }
-    return this.networkStack;
-  }
-
   private async approveFullAccess(
     ctx: ExtensionContext,
     command: string,
@@ -744,8 +722,6 @@ export class BwrapRuntime {
   private reload(ctx: ExtensionCommandContext): void {
     this.resolved = undefined;
     this.bwrapUnavailable = false;
-    void this.networkStack?.stop();
-    this.networkStack = undefined;
     const runtime = this.resolve(ctx);
     ctx.ui.setStatus("bwrap", ctx.ui.theme.fg("accent", `bwrap: ${runtime.mode}`));
     ctx.ui.notify(`bwrap config reloaded (mode: ${runtime.mode})`, "info");