@trim21/personal-pi-extensions 0.1.612 → 0.1.619

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.612",
+  "version": "0.1.619",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/aft/config.ts

@@ -86,8 +86,12 @@ function remoteOf(semantic: RawConfig["semantic"]): SemanticRemote | undefined {
   const backend = trimmedOrUndefined(semantic?.backend);
   // 去掉尾斜杠：aft 侧按 base_url + /embeddings 拼请求。
   const baseUrl = trimmedOrUndefined(semantic?.base_url)?.replace(/\/+$/, "");
-  if (backend === undefined || baseUrl === undefined) return undefined;
-  if (!isRemoteBackend(backend)) return undefined;
+  if (backend === undefined || baseUrl === undefined) {
+    return undefined;
+  }
+  if (!isRemoteBackend(backend)) {
+    return undefined;
+  }
   return {
     backend,
     baseUrl,
@@ -110,7 +114,9 @@ function toReadConfig(raw: RawConfig): AftReadConfig {
  */
 export function loadAftConfig(userConfigPath: string): AftReadConfig {
   try {
-    if (!existsSync(userConfigPath)) return DEFAULTS;
+    if (!existsSync(userConfigPath)) {
+      return DEFAULTS;
+    }
     const parsed: unknown = parse(readFileSync(userConfigPath, "utf8"));
     return toReadConfig(parseWithSchema(rawConfigSchema, parsed ?? {}));
   } catch {

package/src/aft/index.ts

@@ -34,7 +34,9 @@ import {
 export default function aftReadTools(pi: ExtensionAPI): void {
   const cwd = process.cwd();
   const cfg = loadAftConfig(resolveCortexKitConfigPaths(cwd).userConfigPath);
-  if (!cfg.enabled) return;
+  if (!cfg.enabled) {
+    return;
+  }
 
   // bridge 状态跟 session 生命周期走，作用域就是本工厂闭包，不落到模块级。
   let state: Awaited<ReturnType<typeof createAftState>> | null = null;
@@ -88,7 +90,9 @@ export default function aftReadTools(pi: ExtensionAPI): void {
   const shutdown = async (): Promise<void> => {
     const current = state;
     state = null;
-    if (!current) return;
+    if (!current) {
+      return;
+    }
     try {
       await shutdownAftPool(current.pool);
       await current.logger.drain();

package/src/aft/logger.ts

@@ -43,7 +43,9 @@ export function createAftLogger(sessionId?: string): AftLogger {
   }
 
   function flush(): void {
-    if (buffer.length === 0) return;
+    if (buffer.length === 0) {
+      return;
+    }
     const data = buffer.join("");
     buffer = [];
     try {
@@ -54,7 +56,9 @@ export function createAftLogger(sessionId?: string): AftLogger {
   }
 
   function scheduleFlush(): void {
-    if (flushTimer) return;
+    if (flushTimer) {
+      return;
+    }
     flushTimer = setTimeout(() => {
       flushTimer = null;
       flush();
@@ -92,7 +96,9 @@ export function createAftLogger(sessionId?: string): AftLogger {
     getLogFilePath: logFilePath,
     drain: async (): Promise<void> => {
       flush();
-      if (sink) await sink.drain();
+      if (sink) {
+        await sink.drain();
+      }
     },
   };
 }

package/src/aft/tools.ts

@@ -444,7 +444,9 @@ export function subscribeBridgeStatus(
   bridge: AftProjectTransport,
   listener: (snapshot: StatusSnapshot) => void,
 ): (() => void) | undefined {
-  if (!isStatusSubscribable(bridge)) return undefined;
+  if (!isStatusSubscribable(bridge)) {
+    return undefined;
+  }
   return bridge.subscribeStatus(listener);
 }
 

package/src/bwrap/README.md

@@ -6,7 +6,7 @@
 
 ## 进程模型
 
-`network: limited` 模式下，一个沙箱 session 的常驻进程树（宿主侧视角，共 4 个）：
+`network: limited` 模式下，每条命令的网络栈进程树（宿主侧视角，共 4 个）：
 
 ```
 pi 进程（network-stack.ts）
@@ -21,7 +21,7 @@ pi 进程（network-stack.ts）
      必须在宿主 netns 启动（原因见「设计约束」）；持 exit-fd 读端 + tapfd。
 ```
 
-每条命令的短命子树（命令结束即退，与常驻栈无关）：
+每条命令的短命子树（命令结束即退）：
 
 ```
 nsenter -U -n --preserve-credentials -t <①的pid> \
@@ -29,7 +29,8 @@ nsenter -U -n --preserve-credentials -t <①的pid> \
 ```
 
 nsenter 进入 holder 的 userns/netns，bwrap 在里面再嵌套创建自己的 user/pid
-ns 跑命令。一个 session 内 N 条命令复用同一套常驻栈。
+ns 跑命令。网络栈是每条命令现建现停（起栈 ~40ms、停栈 ~100ms），不跨命令复用：
+allowlist 变更因此即时生效，代价是每条命令重新启动一次 mihomo。
 
 ## 网络路径
 
@@ -54,14 +55,16 @@ exit-fd（socketpair）是 slirp4netns 与 holder 之间唯一的生命周期绑
 访问器（`stdio[3].fd` 恒为 undefined），只能经 `_handle.fd` 取原始 fd 再
 dup 给 slirp4netns，且仅在子进程存活期间有效。
 
-| 触发              | 清理链路                                                                                              |
-| ----------------- | ----------------------------------------------------------------------------------------------------- |
-| 正常 `stop()`     | SIGTERM ④（先杀，它 pin 着 netns）→ SIGTERM ① → `--kill-child` 转发给 ② → ② 杀 ③ 退出 → 内核清 pid ns |
-| pi 进程被 SIGKILL | stdin 写端关闭 → ② EOF 自杀 → pid ns 清理 → exit-fd 写端关闭 → ④ HUP 自杀 → tapfd 释放 → netns 销毁   |
-| 单独 kill ①       | PDEATHSIG → ② SIGTERM → 同上；① wait 结束退出 → 写端全关 → ④ 退                                       |
-| 单独 kill ②       | pid-ns init 死 → 内核清 ③；① 退出 → 写端全关 → ④ 退                                                   |
+| 触发                   | 清理链路                                                                                             |
+| ---------------------- | ---------------------------------------------------------------------------------------------------- |
+| 正常 `stop()`          | SIGTERM ④（先杀，它 pin 着 netns）→ SIGKILL ① → PDEATHSIG 给 ② SIGTERM → ② 杀 ③ 退出 → 内核清 pid ns |
+| pi 进程被 SIGKILL      | stdin 写端关闭 → ② EOF 自杀 → pid ns 清理 → exit-fd 写端关闭 → ④ HUP 自杀 → tapfd 释放 → netns 销毁  |
+| 单独 kill ①（SIGKILL） | PDEATHSIG → ② SIGTERM → 同上；① wait 结束退出 → 写端全关 → ④ 退                                      |
+| 单独 kill ②            | pid-ns init 死 → 内核清 ③；① 退出 → 写端全关 → ④ 退                                                  |
 
-四条路径下常驻进程全部收敛、netns 引用归零。
+四条路径下网络栈全部进程收敛、netns 引用归零。注意 `--kill-child` 不是信号转发：
+它的实现是 unshare fork 出的子进程给自己设 PDEATHSIG（unshare 死亡时收到 SIGTERM），
+所以终止 ① 只能靠 SIGKILL（见「设计约束」第 5 条）。
 
 ## 设计约束与教训
 
@@ -81,6 +84,12 @@ dup 给 slirp4netns，且仅在子进程存活期间有效。
    日志；`nsenter -U -n --preserve-credentials -t <holderPid>` 可手动进入
    netns 用 AF_PACKET 抓 tap0 / 检查 `ip rule`（注意：沙盒里看不到宿主机
    进程，宿主机诊断必须在沙盒外做）。
+5. **终止 unshare 只能用 SIGKILL**。util-linux 的 unshare 在 fork 前
+   `sigprocmask(SIG_BLOCK, {SIGINT, SIGTERM})`，且只在子进程里恢复掩码：
+   父进程永久阻塞这两个信号且不装 handler，发给它的 SIGTERM 只会 pending
+   永不投递（实测 3s 后仍存活）。曾因此在 `stop()` 里白等 `waitForExit`
+   的 2000ms 默认超时，把每条命令的沙箱开销从 ~180ms 抬到 ~2.09s。SIGKILL
+   立即生效，PDEATHSIG 再把 SIGTERM 交给 ② 走优雅退出。
 
 ## 调试入口
 

package/src/bwrap/approval-rules.ts

@@ -106,7 +106,9 @@ function extractParts(node: Node): { name: string; args: string[] } {
   };
   for (let i = 0; i < node.childCount; i++) {
     const child = node.child(i);
-    if (child) visit(child);
+    if (child) {
+      visit(child);
+    }
   }
   return { name: name.join(" "), args };
 }
@@ -117,24 +119,34 @@ const FILE_OUTPUT_REDIRECT_OPS = new Set([">", ">>", ">|", "&>", "&>>"]);
 function fileRedirectWritesToFile(node: Node): boolean {
   for (let i = 0; i < node.childCount; i++) {
     const child = node.child(i);
-    if (!child) continue;
-    if (FILE_OUTPUT_REDIRECT_OPS.has(child.type)) return true;
+    if (!child) {
+      continue;
+    }
+    if (FILE_OUTPUT_REDIRECT_OPS.has(child.type)) {
+      return true;
+    }
     // `<>` 被解析成 `<` + 含 `>` 的 ERROR
-    if (child.type === "ERROR" && child.text.includes(">")) return true;
+    if (child.type === "ERROR" && child.text.includes(">")) {
+      return true;
+    }
   }
   return false;
 }
 
 function treeHasFileOutputRedirect(root: Node): boolean {
   for (const node of root.descendantsOfType("file_redirect")) {
-    if (fileRedirectWritesToFile(node)) return true;
+    if (fileRedirectWritesToFile(node)) {
+      return true;
+    }
   }
   return false;
 }
 
 function collectCommand(node: Node, all: Node[]): BashCommand | undefined {
   const { name, args } = extractParts(node);
-  if (!name) return undefined;
+  if (!name) {
+    return undefined;
+  }
   // 嵌套命令 = 完全落在本命令范围内的其他 command 节点（含 `$(...)` 内的）。
   // 用位置判断而非 descendantsOfType 递归：0.26 的 descendantsOfType 会包含
   // 自身且每次返回新 wrapper，`===` 比较失效会无限递归。
@@ -166,7 +178,9 @@ export async function parseBashCommands(command: string): Promise<ParsedBash> {
     const commands: BashCommand[] = [];
     for (const node of all) {
       const parsed = collectCommand(node, all);
-      if (parsed) commands.push(parsed);
+      if (parsed) {
+        commands.push(parsed);
+      }
     }
     return { commands, hasFileOutputRedirect: treeHasFileOutputRedirect(tree.rootNode) };
   } catch (error) {
@@ -189,7 +203,9 @@ export function matchRule(input: string, pattern: string): boolean {
     .replaceAll(/[.+^${}()|[\]\\]/g, String.raw`\$&`)
     .replaceAll("*", ".*")
     .replaceAll("?", ".");
-  if (escaped.endsWith(" .*")) escaped = escaped.slice(0, -3) + "( .*)?";
+  if (escaped.endsWith(" .*")) {
+    escaped = escaped.slice(0, -3) + "( .*)?";
+  }
   return new RegExp(`^${escaped}$`, "s").test(input);
 }
 
@@ -214,16 +230,28 @@ export async function evaluateBashApproval(
   const raws: string[] = [];
   const visit = (cmd: BashCommand) => {
     raws.push(cmd.raw);
-    for (const nested of cmd.nested) visit(nested);
+    for (const nested of cmd.nested) {
+      visit(nested);
+    }
   };
-  for (const cmd of parsed.commands) visit(cmd);
-  if (raws.length === 0) return;
+  for (const cmd of parsed.commands) {
+    visit(cmd);
+  }
+  if (raws.length === 0) {
+    return;
+  }
   let allowed = 0;
   for (const raw of raws) {
     const rule = rules.findLast((r) => matchRule(raw, r.pattern));
-    if (rule?.action === "deny") return "deny";
-    if (rule?.action === "allow") allowed++;
+    if (rule?.action === "deny") {
+      return "deny";
+    }
+    if (rule?.action === "allow") {
+      allowed++;
+    }
+  }
+  if (parsed.hasFileOutputRedirect) {
+    return;
   }
-  if (parsed.hasFileOutputRedirect) return;
   return allowed === raws.length ? "allow" : undefined;
 }

package/src/bwrap/approval-suggest.ts

@@ -30,9 +30,13 @@ export function commandPattern(command: BashCommand): string {
   for (let len = tokens.length; len > 0; len--) {
     const prefix = tokens.slice(0, len).join(" ");
     const arity = ARITY[prefix];
-    if (arity !== undefined) return [...tokens.slice(0, arity), "*"].join(" ");
+    if (arity !== undefined) {
+      return [...tokens.slice(0, arity), "*"].join(" ");
+    }
+  }
+  if (tokens.length === 0) {
+    return "*";
   }
-  if (tokens.length === 0) return "*";
   return [tokens[0], "*"].join(" ");
 }
 
@@ -41,9 +45,13 @@ function patternsFromCommands(commands: BashCommand[]): string[] {
   const flat: string[] = [];
   const visit = (cmd: BashCommand) => {
     flat.push(commandPattern(cmd));
-    for (const nested of cmd.nested) visit(nested);
+    for (const nested of cmd.nested) {
+      visit(nested);
+    }
   };
-  for (const cmd of commands) visit(cmd);
+  for (const cmd of commands) {
+    visit(cmd);
+  }
   return flat;
 }
 

package/src/bwrap/core.ts

@@ -226,7 +226,9 @@ export function loadBwrapConfig(cwd: string, paths = getBwrapConfigPaths(cwd)):
   // 去重：调用方用同一路径表达「只读这一个文件」时不做二次合并
   // （否则 extraWritablePaths / approvalRules 会被重复拼接）
   for (const path of new Set([paths.global, paths.project])) {
-    if (!existsSync(path)) continue;
+    if (!existsSync(path)) {
+      continue;
+    }
     config = deepMerge(config, parseBwrapConfigFile(path));
   }
   return Value.Parse(bwrapConfigSchema, config);
@@ -241,14 +243,18 @@ function findDefaultBwrap(): string {
   const pathEnv = process.env.PATH ?? "";
   for (const directory of pathEnv.split(delimiter)) {
     const candidate = join(directory, "bwrap");
-    if (existsSync(candidate)) return candidate;
+    if (existsSync(candidate)) {
+      return candidate;
+    }
   }
   for (const candidate of [
     "/usr/bin/bwrap",
     "/usr/local/bin/bwrap",
     "/run/current-system/sw/bin/bwrap",
   ]) {
-    if (existsSync(candidate)) return candidate;
+    if (existsSync(candidate)) {
+      return candidate;
+    }
   }
   throw new Error(
     "bwrap (bubblewrap) not found in PATH. Install it:\n" +
@@ -272,7 +278,9 @@ function findCommandInPath(name: string, hint: string): string {
   const pathEnv = process.env.PATH ?? "";
   for (const directory of pathEnv.split(delimiter)) {
     const candidate = join(directory, name);
-    if (existsSync(candidate)) return candidate;
+    if (existsSync(candidate)) {
+      return candidate;
+    }
   }
   throw new Error(hint);
 }
@@ -335,7 +343,9 @@ class ScanLimitError extends Error {}
 export async function findGitDirs(root: string): Promise<string[]> {
   const found: string[] = [];
   const walk = async (dir: string, depth: number): Promise<void> => {
-    if (depth > MAX_GIT_SCAN_DEPTH) return;
+    if (depth > MAX_GIT_SCAN_DEPTH) {
+      return;
+    }
     let entries: Dirent[];
     try {
       entries = await readdir(dir, { withFileTypes: true });
@@ -343,19 +353,25 @@ export async function findGitDirs(root: string): Promise<string[]> {
       return;
     }
     for (const entry of entries) {
-      if (found.length >= MAX_GIT_DIRS) throw new ScanLimitError();
+      if (found.length >= MAX_GIT_DIRS) {
+        throw new ScanLimitError();
+      }
       if (entry.name === ".git" && entry.isDirectory()) {
         found.push(join(dir, ".git"));
         continue;
       }
-      if (!entry.isDirectory() || GIT_DIR_SCAN_SKIP.has(entry.name)) continue;
+      if (!entry.isDirectory() || GIT_DIR_SCAN_SKIP.has(entry.name)) {
+        continue;
+      }
       await walk(join(dir, entry.name), depth + 1);
     }
   };
   try {
     await walk(root, 0);
   } catch (error) {
-    if (!(error instanceof ScanLimitError)) throw error;
+    if (!(error instanceof ScanLimitError)) {
+      throw error;
+    }
   }
   return found;
 }
@@ -403,7 +419,9 @@ export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Prom
       args.push("--ro-bind-try", "/dev/null", target);
     }
   }
-  if (resolved.network === "block") args.push("--unshare-net");
+  if (resolved.network === "block") {
+    args.push("--unshare-net");
+  }
   // fs allow-all：整棵根可写，不做保护绑定（.pi/.agent/.git 的只读覆盖与「完整可写」矛盾）。
   if (resolved.fs !== "allow-all") {
     // --ro-bind-try：目录不存在（或已被删除）时自动忽略
@@ -432,7 +450,9 @@ export async function buildBwrapArgs(resolved: ResolvedBwrap, cwd: string): Prom
 }
 
 function killChild(child: ChildProcess): void {
-  if (!child.pid) return;
+  if (!child.pid) {
+    return;
+  }
   try {
     process.kill(-child.pid, "SIGKILL");
   } catch {
@@ -450,7 +470,9 @@ export async function createNetworkStack(
   resolved: ResolvedBwrap,
   log?: NetworkStackLog,
 ): Promise<NetworkStack | undefined> {
-  if (resolved.network !== "limited") return undefined;
+  if (resolved.network !== "limited") {
+    return undefined;
+  }
   return startNetworkStack({
     allowlist: resolved.networkAllowlist,
     dnsServers: await resolveDnsServers(),
@@ -584,7 +606,9 @@ export function createBwrapBashOperations(
         signal?.addEventListener("abort", onAbort, { once: true });
         child.once("error", reject);
         child.once("close", (exitCode) => {
-          if (timeoutHandle) clearTimeout(timeoutHandle);
+          if (timeoutHandle) {
+            clearTimeout(timeoutHandle);
+          }
           signal?.removeEventListener("abort", onAbort);
           // 中断：reject signal.reason（默认是 name=AbortError 的 DOMException）
           if (signal?.aborted) {
@@ -596,7 +620,9 @@ export function createBwrapBashOperations(
           } else if (timedOut) {
             // 超时：name=TimeoutError（对齐标准错误分类）
             reject(new TimeoutError(timeout));
-          } else resolve({ exitCode });
+          } else {
+            resolve({ exitCode });
+          }
         });
       });
     },

package/src/bwrap/dcg-scan.ts

@@ -50,7 +50,9 @@ export async function dcgSuggestion(command: string): Promise<DcgScanOutcome> {
   try {
     stdout = await runDcgScan(command);
   } catch (error) {
-    if ((error as NodeJS.ErrnoException).code === "ENOENT") return { kind: "not-installed" };
+    if ((error as NodeJS.ErrnoException).code === "ENOENT") {
+      return { kind: "not-installed" };
+    }
     return { kind: "failed", detail: error instanceof Error ? error.message : String(error) };
   }
 
@@ -102,11 +104,16 @@ function runDcgScan(command: string): Promise<string> {
       settle(new Error("dcg scan timed out"));
     }, DCG_SCAN_TIMEOUT_MS);
     const settle = (error?: Error) => {
-      if (settled) return;
+      if (settled) {
+        return;
+      }
       settled = true;
       clearTimeout(timeoutId);
-      if (error) reject(error);
-      else resolve(stdout);
+      if (error) {
+        reject(error);
+      } else {
+        resolve(stdout);
+      }
     };
     proc.stdout.setEncoding("utf8");
     proc.stdout.on("data", (chunk: string) => {
@@ -119,8 +126,11 @@ function runDcgScan(command: string): Promise<string> {
     proc.on("close", (code) => {
       // dcg 的退出码是决策结果（deny 时非 0），不是失败标志：只要 stdout
       // 有内容就交给上层解析；真正出错时（参数错误等）stdout 为空。
-      if (code === 0 || stdout.length > 0) settle();
-      else settle(new Error(`dcg exited with code ${String(code)}`));
+      if (code === 0 || stdout.length > 0) {
+        settle();
+      } else {
+        settle(new Error(`dcg exited with code ${String(code)}`));
+      }
     });
     proc.stdin.end(command);
   });

package/src/bwrap/holder.ts

@@ -34,7 +34,9 @@ async function waitFor(
   predicate: () => Promise<boolean>,
 ): Promise<boolean> {
   for (let i = 0; i < attempts; i++) {
-    if (await predicate()) return true;
+    if (await predicate()) {
+      return true;
+    }
     await sleep(delayMs);
   }
   return false;

package/src/bwrap/mihomo-config.ts

@@ -58,7 +58,9 @@ function isIp(host: string): boolean {
 
 /** 单 IP 补掩码为 CIDR（IPv4 /32、IPv6 /128），带掩码原样返回。 */
 function toCidr(host: string): string {
-  if (host.includes("/")) return host;
+  if (host.includes("/")) {
+    return host;
+  }
   return host.includes(":") ? `${host}/128` : `${host}/32`;
 }
 
@@ -79,7 +81,9 @@ function parseAllowlistEntry(entry: string): AllowlistEntry {
   let port: number | undefined;
   if (entry.startsWith("[")) {
     const match = /^\[(.+)\](?::(\d+))?$/.exec(entry);
-    if (match?.[1] === undefined) throw new Error(`Invalid allowlist entry "${entry}"`);
+    if (match?.[1] === undefined) {
+      throw new Error(`Invalid allowlist entry "${entry}"`);
+    }
     host = match[1];
     // 端口组 (?::(\d+))? 可选：无端口时 at(2) 是 undefined
     const portPart = match.at(2);
@@ -87,13 +91,19 @@ function parseAllowlistEntry(entry: string): AllowlistEntry {
   } else {
     const colon = entry.lastIndexOf(":");
     if (colon === -1) {
-      if (entry.length === 0) throw new Error(`Invalid allowlist entry ""`);
+      if (entry.length === 0) {
+        throw new Error(`Invalid allowlist entry ""`);
+      }
       host = entry;
     } else {
       const portPart = entry.slice(colon + 1);
-      if (!/^\d+$/.test(portPart)) throw new Error(`Invalid allowlist entry "${entry}"`);
+      if (!/^\d+$/.test(portPart)) {
+        throw new Error(`Invalid allowlist entry "${entry}"`);
+      }
       host = entry.slice(0, colon);
-      if (host.length === 0) throw new Error(`Invalid allowlist entry "${entry}"`);
+      if (host.length === 0) {
+        throw new Error(`Invalid allowlist entry "${entry}"`);
+      }
       if (host.includes(":")) {
         throw new Error(`IPv6 addresses must be wrapped in brackets, e.g. "[${host}]:${portPart}"`);
       }
@@ -101,7 +111,9 @@ function parseAllowlistEntry(entry: string): AllowlistEntry {
     }
   }
   if (isIp(host)) {
-    if (!IP_CHARS_PATTERN.test(host)) throw new Error(`Invalid allowlist entry "${entry}"`);
+    if (!IP_CHARS_PATTERN.test(host)) {
+      throw new Error(`Invalid allowlist entry "${entry}"`);
+    }
   } else if (!DOMAIN_PATTERN.test(host)) {
     throw new Error(`Invalid allowlist entry "${entry}"`);
   }