@trim21/personal-pi-extensions 0.1.20261012010044 → 0.1.20261012031237

package/src/codemode/worker.ts

@@ -13,9 +13,9 @@ import { parentPort, workerData } from "node:worker_threads";
 
 import { JSException, type JSValueHandle, MAX_STACK_SIZE, QuickJS } from "quickjs-wasi";
 
+import { isRecord } from "../lib/narrow.js";
 import { PRELUDE_SOURCE } from "./prelude.js";
 import {
-  decodeHostMessage,
   type HostMessage,
   MEMORY_LIMIT_BYTES,
   type ScriptError,
@@ -46,6 +46,28 @@ function post(message: WorkerMessage): void {
   parentPort?.postMessage(message);
 }
 
+/**
+ * 主线程发来的消息由主线程自己构造，形状由 `HostMessage` 类型约束，所以这里只做分派、
+ * 不重复 typebox 校验；但形状对不上就是内部 bug，得报错而不是静默丢弃——静默丢弃只会
+ * 让脚本永远等在 pending 上，症状比故障本身难查得多。
+ */
+function isResultMessage(value: unknown): value is Extract<HostMessage, { t: "result" }> {
+  return isRecord(value) && value.t === "result" && typeof value.id === "number";
+}
+
+function isStartMessage(value: unknown): value is Extract<HostMessage, { t: "start" }> {
+  return isRecord(value) && value.t === "start";
+}
+
+/** 畸形消息的预览：截断成一行，序列化不了（循环引用、undefined 等）就退化成 String()。 */
+function previewMessage(value: unknown): string {
+  try {
+    return JSON.stringify(value).slice(0, 200);
+  } catch {
+    return String(value);
+  }
+}
+
 function emptyWrites(): StoreWrites {
   return { set: {}, delete: [] };
 }
@@ -111,6 +133,8 @@ async function runScript(wasm: object, start: Extract<HostMessage, { t: "start"
     ) => {
       const stringOr = (value: JSValueHandle | undefined, fallback: string): string =>
         value === undefined || value.isUndefined ? fallback : value.toString();
+      const numberOr = (value: JSValueHandle | undefined, fallback: number): number =>
+        value === undefined || value.isUndefined ? fallback : value.toNumber();
       switch (kind.toString()) {
         case "call": {
           post({
@@ -138,6 +162,22 @@ async function runScript(wasm: object, start: Extract<HostMessage, { t: "start"
           });
           break;
         }
+        case "sleep": {
+          // 用 worker 线程自己的定时器：不经主线程，也没有消息往返
+          const id = a.toNumber();
+          const ms = numberOr(b, 0);
+          setTimeout(() => {
+            try {
+              vm.withScope(() => {
+                vm.callFunction(timerDone, api, vm.newNumber(id)).dispose();
+              });
+            } catch {
+              /* VM 已中止 */
+            }
+            drain();
+          }, ms);
+          break;
+        }
         case "done": {
           const writes =
             c === undefined || c.isUndefined ? emptyWrites() : parseWrites(c.toString());
@@ -186,6 +226,7 @@ async function runScript(wasm: object, start: Extract<HostMessage, { t: "start"
     ),
   );
   const settle = api.getProp("settle");
+  const timerDone = api.getProp("timerDone");
   const run = api.getProp("run");
   const stalled = api.getProp("stalled");
 
@@ -196,23 +237,31 @@ async function runScript(wasm: object, start: Extract<HostMessage, { t: "start"
   };
 
   port.on("message", (value: unknown) => {
-    const message = decodeHostMessage(value);
-    if (!message.ok || message.frame.t !== "result") {
+    if (!isResultMessage(value)) {
+      // 主线程只会发 result：对不上就是宿主自己的 bug，报出去而不是静默让脚本挂住
+      post({
+        t: "done",
+        ok: false,
+        error: {
+          kind: "sandbox",
+          message: `codemode worker: unexpected host message: ${previewMessage(value)}`,
+        },
+        writes: emptyWrites(),
+      });
       return;
     }
-    const result = message.frame;
     try {
       vm.withScope(() => {
         vm.callFunction(
           settle,
           api,
-          vm.newNumber(result.id),
-          result.ok ? vm.true : vm.false,
-          result.ok
-            ? result.value === undefined
+          vm.newNumber(value.id),
+          value.ok ? vm.true : vm.false,
+          value.ok
+            ? value.value === undefined
               ? vm.undefined
-              : vm.newString(JSON.stringify(result.value))
-            : vm.newString(result.error),
+              : vm.newString(JSON.stringify(value.value))
+            : vm.newString(value.error),
         );
       });
     } catch {
@@ -256,8 +305,7 @@ function main(): void {
   const { wasm } = workerData as WorkerBootstrap;
   // 主线程先发 start；worker 收到后才实例化 VM（wasm 已在主线程编译好）
   port.once("message", (value: unknown) => {
-    const message = decodeHostMessage(value);
-    if (!message.ok || message.frame.t !== "start") {
+    if (!isStartMessage(value)) {
       post({
         t: "done",
         ok: false,
@@ -266,7 +314,7 @@ function main(): void {
       });
       return;
     }
-    void runScript(wasm, message.frame);
+    void runScript(wasm, value);
   });
 }
 

package/src/lib/tool-bus.ts

@@ -55,6 +55,7 @@ export interface StructuredToolDefinition<
     signal: AbortSignal | undefined,
     onUpdate: AgentToolUpdateCallback<TDetails> | undefined,
     ctx: ExtensionContext,
+    callOptions?: ToolCallOptions,
   ): Promise<AgentToolResult<TDetails> & { structuredResult: StructuredResult<Static<TOutput>> }>;
 }
 
@@ -111,16 +112,37 @@ export interface CodemodeToolDefinition<
   ): Promise<StructuredResult<Static<TOutput>>>;
 }
 
+/**
+ * 工具 `execute` 的额外调用选项：只有本仓库自己的调用路径会传（目前是 codemode 的嵌套
+ * 调用），pi 直接调用工具时它永远是 `undefined`。因此在 pi 的 `ToolDefinition` 之外，
+ * 总线单独把 `execute` 的签名放宽一个可选参数。
+ */
+export interface ToolCallOptions {
+  /** 本次调用不可请求用户审批：需要授权的操作直接失败，不弹审批框。 */
+  unapprovable?: boolean;
+}
+
 /**
  * 注册后的定义：`codemodeOnly` 标出未交给 pi 的脚本工具。`structuredSchema` 供 codemode
  * 渲染脚本侧返回类型；`scripted` 区分「`execute` 直接返回结构化结果」的脚本工具与经配置
  * 转成 codemode-only 的普通工具（后者仍返回 `AgentToolResult`，结构化结果在
  * `structuredResult` 里）。
  */
-export type RegisteredToolDefinition = ToolDefinition<TSchema, unknown, unknown> & {
+export type RegisteredToolDefinition = Omit<
+  ToolDefinition<TSchema, unknown, unknown>,
+  "execute"
+> & {
   structuredSchema?: TSchema;
   codemodeOnly?: boolean;
   scripted?: true;
+  execute(
+    toolCallId: string,
+    params: unknown,
+    signal: AbortSignal | undefined,
+    onUpdate: AgentToolUpdateCallback<unknown> | undefined,
+    ctx: ExtensionContext,
+    callOptions?: ToolCallOptions,
+  ): Promise<AgentToolResult<unknown>>;
 };
 
 export interface ToolBus {
@@ -416,6 +438,8 @@ export function createToolBus(pi: ExtensionAPI, options: ToolBusOptions = {}): T
           options.signal,
           options.onUpdate,
           options.ctx,
+          // codemode 的嵌套调用弹不了审批框：需要授权的操作直接失败
+          { unapprovable: true },
         );
         if (definition.scripted === true) {
           return checkScriptedResult(name, definition.structuredSchema, result);

package/src/lib/write-guard.ts

@@ -139,6 +139,8 @@ export interface WriteGuardOptions {
   policy: RequestPolicy;
   /** 工具调用的中止信号：透传给审批对话框，工具被取消时对话框一起关掉。 */
   signal?: AbortSignal;
+  /** 本次调用不可请求用户审批（codemode 的嵌套调用）：区外写入直接失败，不弹框。 */
+  unapprovable?: boolean;
 }
 
 /**
@@ -164,6 +166,13 @@ export async function guardWriteAccess(
     throw new Error(`user deny ${opts.toolName}: blocked`);
   }
 
+  // codemode 内不弹审批：那次嵌套调用只经 codemode 暴露，弹不了框，因此直接失败并提示直调
+  if (opts.unapprovable === true) {
+    throw new Error(
+      `${opts.toolName} needs user approval to write outside the workspace, which codemode cannot ask for. Call the tool directly instead of from a script.`,
+    );
+  }
+
   if (process.platform === "win32") {
     // Windows 上退化为「只能写工作区」：无沙箱兜底，工作区外写入一律拒绝，
     // 不提供审批路径。

package/src/opencode/bash.ts

@@ -95,7 +95,7 @@ export function registerBashTool(bus: ToolBus, pi: ExtensionAPI, runtime: BwrapR
         },
         { additionalProperties: false },
       ),
-      async execute(id, params, signal, onUpdate, ctx) {
+      async execute(id, params, signal, onUpdate, ctx, callOptions) {
         const timeout = params.timeout ?? BASH_DEFAULT_TIMEOUT_MS;
         if (!Number.isFinite(timeout) || timeout <= 0 || timeout > BASH_MAX_TIMEOUT_MS) {
           throw new Error(`timeout must be between 1 and ${BASH_MAX_TIMEOUT_MS} milliseconds`);
@@ -115,6 +115,7 @@ export function registerBashTool(bus: ToolBus, pi: ExtensionAPI, runtime: BwrapR
             description: params.description,
             signal,
             onUpdate,
+            unapprovable: callOptions?.unapprovable,
           });
         } catch (error) {
           if (!(error instanceof Error)) {