@trim21/personal-pi-extensions 0.1.445 → 0.1.446

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.445",
+  "version": "0.1.446",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/bwrap/holder.js

@@ -1,16 +1,15 @@
 import { spawn } from "node:child_process";
-import { rmSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { dirname } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 const args = process.argv.slice(2);
-const configPath = args[0];
+const configBase64 = args[0];
 const mihomoPath = args[1];
 const slirp4netnsPath = args[2];
 const tunMtu = Number(args[3]);
-if (!configPath || !mihomoPath || !slirp4netnsPath || !tunMtu) {
+if (!configBase64 || !mihomoPath || !slirp4netnsPath || !tunMtu) {
   process.exit(2);
 }
+process.chdir("/");
 function tap0Exists() {
   return new Promise((resolve) => {
     const child = spawn("ip", ["link", "show", "tap0"], { stdio: "ignore" });
@@ -27,10 +26,7 @@ async function waitFor(attempts, delayMs, predicate) {
 }
 async function main() {
   process.stdin.resume();
-  process.stdin.on("end", () => {
-    rmSync(dirname(configPath), { recursive: true, force: true });
-    process.exit(0);
-  });
+  process.stdin.on("end", () => process.exit(0));
   const status = await readFile("/proc/self/status", "utf8");
   const hostPid = /^NSpid:\s+(.+)$/m.exec(status)?.[1].split(/\s+/, 1)[0];
   if (!hostPid) {
@@ -40,7 +36,7 @@ async function main() {
     stdio: ["ignore", "inherit", "inherit"]
   });
   await waitFor(100, 100, tap0Exists);
-  const mihomo = spawn(mihomoPath, ["-d", dirname(configPath), "-f", configPath], {
+  const mihomo = spawn(mihomoPath, ["-config", configBase64], {
     stdio: ["ignore", "inherit", "inherit"]
   });
   const stop = () => {

package/src/bwrap/holder.ts

@@ -1,22 +1,23 @@
 /* eslint-disable no-console, unicorn/no-process-exit -- 独立 CLI 脚本，由 unshare 直接执行 */
 import { spawn } from "node:child_process";
-import { rmSync } from "node:fs";
 import { readFile } from "node:fs/promises";
-import { dirname } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 
-// 用法：unshare -Urnp --fork --kill-child node holder.ts <config> <mihomo> <slirp4netns> <mtu>
+// 用法：unshare -Urnp --fork --kill-child node holder.ts <config-base64> <mihomo> <slirp4netns> <mtu>
 // 本进程是 pid namespace 的 init：无论以何种方式退出（含 SIGKILL），内核都会清理该 pid ns 内的
 // slirp4netns / mihomo，userns/netns 引用随之归零。
 const args = process.argv.slice(2);
-const configPath = args[0];
+const configBase64 = args[0];
 const mihomoPath = args[1];
 const slirp4netnsPath = args[2];
 const tunMtu = Number(args[3]);
-if (!configPath || !mihomoPath || !slirp4netnsPath || !tunMtu) {
+if (!configBase64 || !mihomoPath || !slirp4netnsPath || !tunMtu) {
   process.exit(2);
 }
 
+// mihomo 不写工作目录（配置经 -config 直传），切到根目录防止在宿主 cwd 意外落盘
+process.chdir("/");
+
 function tap0Exists(): Promise<boolean> {
   return new Promise((resolve) => {
     const child = spawn("ip", ["link", "show", "tap0"], { stdio: "ignore" });
@@ -39,12 +40,9 @@ async function waitFor(
 
 async function main(): Promise<void> {
   // 宿主（pi）进程死亡检测：宿主以任何方式退出（含 SIGKILL）都会关闭它持有的 stdin 写端，
-  // 这里读到 EOF 即自杀（init 退出即触发内核清理整个 pid ns），顺带删除配置目录。
+  // 这里读到 EOF 即自杀（init 退出即触发内核清理整个 pid ns）。
   process.stdin.resume();
-  process.stdin.on("end", () => {
-    rmSync(dirname(configPath), { recursive: true, force: true });
-    process.exit(0);
-  });
+  process.stdin.on("end", () => process.exit(0));
 
   // 宿主视角 pid（NSpid 第一项）：/proc 挂载是宿主的（-Urnp 不含 -m，宿主视角下
   // /proc/1 是 systemd 而非本 pid ns 的 init），slirp4netns 的 setns 必须走宿主 /proc
@@ -63,7 +61,7 @@ async function main(): Promise<void> {
   // mihomo 日志透传到 holder 的 stdout/stderr，宿主侧监听 "Tun adapter listening" 判定就绪
   await waitFor(100, 100, tap0Exists);
 
-  const mihomo = spawn(mihomoPath, ["-d", dirname(configPath), "-f", configPath], {
+  const mihomo = spawn(mihomoPath, ["-config", configBase64], {
     stdio: ["ignore", "inherit", "inherit"],
   });
 

package/src/bwrap/network-stack.ts

@@ -1,10 +1,8 @@
 import { type ChildProcess, spawn } from "node:child_process";
-import { mkdtemp, readFile, readlink, rm, writeFile } from "node:fs/promises";
-import { join } from "node:path";
+import { readFile, readlink } from "node:fs/promises";
 import { fileURLToPath } from "node:url";
 
-import { getAgentDir } from "@earendil-works/pi-coding-agent";
-
+import { forEachLine } from "../lib/proc.js";
 import { generateMihomoConfig, TUN_MTU } from "./mihomo-config.js";
 
 /** 命令超时错误：name=TimeoutError（对齐标准错误分类），message 保留 timeout:N 格式。 */
@@ -120,16 +118,23 @@ function waitForMihomoStarted(holder: ChildProcess, timeoutMs = 20000): Promise<
       settled = true;
       reject(new Error("Timed out waiting for mihomo to start"));
     }, timeoutMs);
-    const onData = (data: Buffer): void => {
+    const onReady = (): void => {
       if (settled) return;
-      if (data.toString().includes("Tun adapter listening")) {
-        settled = true;
-        clearTimeout(timer);
-        resolve();
-      }
+      settled = true;
+      clearTimeout(timer);
+      resolve();
     };
-    holder.stdout?.on("data", onData);
-    holder.stderr?.on("data", onData);
+    // 按行扫描：mihomo 日志行可能跨 data chunk，由 forEachLine 负责拼接
+    for (const stream of [holder.stdout, holder.stderr]) {
+      if (stream) {
+        // 不提前停止：holder 生命周期内持续消费输出，避免流无消费者触发背压
+        void forEachLine(stream, (line) => {
+          if (line.includes("Tun adapter listening")) onReady();
+        }).catch(() => {
+          // 就绪判定由超时与 holder exit 兜底，流的 error 忽略
+        });
+      }
+    }
     holder.once("exit", (code) => {
       if (settled) return;
       settled = true;
@@ -169,20 +174,16 @@ export interface NetworkStack {
   stop(): Promise<void>;
   /** holder pid：可 `nsenter -U -n --preserve-credentials -t <pid>` 手动进入该 netns 排查。 */
   readonly holderPid: number;
-  /** 生成的 mihomo 配置路径（stop() 后随临时目录一起删除）。 */
-  readonly configPath: string;
 }
 
 interface NetworkStackState {
   holderPid: number;
-  directory: string;
 }
 
-/** 兜底：调用方忘记 stop() 时，对象被 GC 回收后 kill 残留进程并清理目录。 */
+/** 兜底：调用方忘记 stop() 时，对象被 GC 回收后 kill 残留进程。 */
 const stackFinalizer = new FinalizationRegistry<NetworkStackState>((state) => {
   // SIGTERM 经 unshare --kill-child 转发给 init，内核清理 pid ns 内全部进程
   killProcess(state.holderPid);
-  void rm(state.directory, { recursive: true, force: true }).catch(() => false);
 });
 
 /**
@@ -198,11 +199,9 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
     slirp4netnsPath,
     onHolderOutput: holderOutput,
   } = options;
-  // 临时目录放在 agent-dir/tmp（pi 自有临时区），不污染系统 /tmp
-  const directory = await mkdtemp(join(getAgentDir(), "tmp", "pi-netns-"));
-  const configPath = join(directory, "mihomo.json");
+  // mihomo 支持 -config 直接接收 base64 配置，无需写配置文件中转
   const config = generateMihomoConfig({ allowlist, dnsServers });
-  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\n`);
+  const configBase64 = Buffer.from(JSON.stringify(config)).toString("base64");
 
   let holder: ChildProcess | undefined;
   try {
@@ -218,7 +217,7 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
         "--",
         "node",
         HOLDER_PATH,
-        configPath,
+        configBase64,
         mihomoPath,
         slirp4netnsPath,
         String(TUN_MTU),
@@ -242,7 +241,7 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
 
     await waitForMihomoStarted(holder);
 
-    const state: NetworkStackState = { holderPid, directory };
+    const state: NetworkStackState = { holderPid };
     const stack: NetworkStack = {
       exec: async (execOptions: NetworkStackExecOptions) => {
         const child = spawn(
@@ -320,10 +319,8 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
         for (const pid of children) {
           killProcess(pid, "SIGKILL");
         }
-        await rm(state.directory, { recursive: true, force: true }).catch(() => false);
       },
       holderPid,
-      configPath,
     };
     stackFinalizer.register(stack, state);
     return stack;
@@ -338,7 +335,6 @@ export async function startNetworkStack(options: NetworkStackOptions): Promise<N
         killProcess(pid, "SIGKILL");
       }
     }
-    await rm(directory, { recursive: true, force: true }).catch(() => false);
     throw error;
   }
 }

package/src/lib/proc.ts

@@ -0,0 +1,20 @@
+/**
+ * 按行消费输出流：data 事件按 buffer 边界切分，行可能跨多个 chunk，
+ * 这里拼接缓冲后按 \n 逐行回调（回调不含换行符）。
+ * 回调返回 false 可提前停止消费；流的 error 会以 rejection 形式抛出。
+ */
+export async function forEachLine(
+  stream: NodeJS.ReadableStream,
+  callback: (line: string) => boolean | void,
+): Promise<void> {
+  let buffer = "";
+  for await (const chunk of stream) {
+    buffer += chunk.toString();
+    let newline: number;
+    while ((newline = buffer.indexOf("\n")) !== -1) {
+      const line = buffer.slice(0, newline);
+      buffer = buffer.slice(newline + 1);
+      if (callback(line) === false) return;
+    }
+  }
+}