@trim21/personal-pi-extensions 0.1.635 → 0.1.636

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trim21/personal-pi-extensions",
-  "version": "0.1.635",
+  "version": "0.1.636",
   "type": "module",
   "description": "Custom pi coding-agent extensions: bwrap sandbox, workspace guard, opencode edit, and more",
   "keywords": [

package/src/gh/base.ts

@@ -12,7 +12,8 @@ import { delimiter, join } from "node:path";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 
-import { type GhResult, httpProxy, runGh } from "../lib/gh-process.js";
+import { egress } from "../lib/egress.js";
+import { type GhResult, runGh } from "../lib/gh-process.js";
 import {
   type ActionJob,
   type CheckRun,
@@ -344,7 +345,7 @@ export class GhClient {
   readonly checks: GithubChecksClient;
 
   constructor(
-    fetchImpl: typeof globalThis.fetch = httpProxy.fetch,
+    fetchImpl: typeof globalThis.fetch = egress.fetch,
     options: Pick<GithubClientOptions, "token"> = {},
   ) {
     this.fetch = fetchImpl;

package/src/lib/egress.ts

@@ -0,0 +1,29 @@
+/**
+ * 出网入口：代理配置的解析、dispatcher 与 NO_PROXY 分流仍在 `src/lib/proxy.ts`（代理
+ * 适配器），本模块只把它收敛成一处，让所有出网调用方从同一处取 `fetch` 与子进程代理
+ * 环境变量，并保持「配置写错即加载失败」的行为——不静默直连。
+ */
+
+import { createHttpProxy, type HttpProxySettings } from "./proxy.js";
+
+/**
+ * 出网的单一入口：需要的调用方从这里取请求用的 fetch 与子进程代理环境变量，
+ * 不必各自判断「该用代理 fetch 还是全局 fetch」。
+ */
+export interface Egress {
+  /** 生效的代理设置，供诊断与展示。 */
+  readonly settings: HttpProxySettings;
+  /** 请求用的 fetch：undici 的 fetch，配置了代理时自动走代理（NO_PROXY 由 dispatcher 处理）。 */
+  readonly fetch: typeof globalThis.fetch;
+  /** 要注入子进程的代理环境变量；未配置代理时为空对象。 */
+  readonly env: NodeJS.ProcessEnv;
+}
+
+/** 组装出网层（读一次代理配置；配置写错直接抛）。 */
+export function createEgress(): Egress {
+  const proxy = createHttpProxy();
+  return { settings: proxy.settings, fetch: proxy.fetch, env: proxy.env };
+}
+
+/** 共享出网实例：进程内所有出网调用方共用（代理配置在扩展加载时读一次）。 */
+export const egress: Egress = createEgress();

package/src/lib/gh-process.ts

@@ -1,19 +1,13 @@
 /**
  * `gh` subprocess adapter: start a `gh` process, collect its output, apply the
- * shared timeout / kill semantics, and expose the proxy layer the subprocess
- * inherits. It lives in `lib/` so both the gh tool layer (`src/gh/`) and the
- * octokit clients (`lib/github.ts`) can depend on it without a cycle.
+ * shared timeout / kill semantics, and hand it the proxy env from the shared
+ * egress layer. It lives in `lib/` so both the gh tool layer (`src/gh/`) and
+ * the octokit clients (`lib/github.ts`) can depend on it without a cycle.
  */
 
 import { spawn } from "node:child_process";
 
-import { createHttpProxy } from "./proxy.js";
-
-/**
- * 代理配置（~/.pi/agent/proxy.json，回退到 HTTP(S)_PROXY 环境变量）在本模块内共享：
- * `gh` 子进程与 octokit 请求都从这里取，配置只在首次使用时读一次。
- */
-export const httpProxy = createHttpProxy();
+import { egress } from "./egress.js";
 
 export interface GhResult {
   stdout: string;
@@ -42,7 +36,7 @@ export function runGh(args: string[], ctx: GhRunContext): Promise<GhResult> {
       shell: false,
       stdio: ["ignore", "pipe", "pipe"],
       // gh 是 Go 程序，只认环境变量形式的代理配置；ctx.env 最后合并，调用方可覆盖。
-      env: { ...process.env, ...httpProxy.env, ...ctx.env, GH_PAGER: "cat" },
+      env: { ...process.env, ...egress.env, ...ctx.env, GH_PAGER: "cat" },
     });
 
     let stdout = "";

package/src/web/fetch.ts

@@ -4,9 +4,9 @@
  * SSRF 防护：DNS 预解析 + 拒绝私有/保留地址 + 每跳重定向重新校验，
  * 防止把 agent 变成内网探测口。正文提取用 readability 主内容算法。
  *
- * 出网走 `src/lib/proxy.ts` 的代理层（~/.pi/agent/proxy.json，回退 HTTPS_PROXY 等环境
- * 变量）：Node 的全局 fetch 不认代理环境变量，GitHub 的用户附件、release 资产这类只在
- * 代理可达的 host 上，必须从这里挂出去，否则沙箱内一律 fetch failed。
+ * 出网走共享出网层 `src/lib/egress.ts`（代理配置 ~/.pi/agent/proxy.json，回退 HTTPS_PROXY
+ * 等环境变量）：Node 的全局 fetch 不认代理环境变量，GitHub 的用户附件、release 资产这类
+ * 只在代理可达的 host 上，必须从这里挂出去，否则沙箱内一律 fetch failed。
  *
  * 本文件是独立扩展入口（见 package.json 的 pi.extensions），可在配置里单独禁用。
  */
@@ -21,13 +21,11 @@ import { parseHTML } from "linkedom";
 import TurndownService from "turndown";
 import { Type } from "typebox";
 
+import { egress } from "../lib/egress.js";
 import { resolvePathArg } from "../lib/path.js";
-import { createHttpProxy } from "../lib/proxy.js";
 import { createRequestPolicy } from "../lib/request-policy.js";
 import { guardWriteAccess } from "../lib/write-guard.js";
 
-const httpProxy = createHttpProxy();
-
 const MAX_REDIRECTS = 5;
 const TIMEOUT_MS = 30_000;
 const MAX_BYTES = 5 * 1024 * 1024;
@@ -143,7 +141,7 @@ interface SavedFile {
 async function fetchWithRedirects(
   url: URL,
   signal: AbortSignal | undefined,
-  fetchFn: typeof fetch = httpProxy.fetch,
+  fetchFn: typeof fetch = egress.fetch,
 ): Promise<{ response: Response; url: URL }> {
   let current = url;
   for (let redirects = 0; ; redirects++) {

package/src/web/search.ts

@@ -11,6 +11,7 @@ import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
 import { Type } from "typebox";
 import { Value } from "typebox/value";
 
+import { egress } from "../lib/egress.js";
 import { loadSearch1ApiKey } from "./config.js";
 
 const SEARCH_URL = "https://api.search1api.com/search";
@@ -150,7 +151,7 @@ export async function searchWeb(
   apiKey: string,
   options: SearchOptions = {},
 ): Promise<SearchResult> {
-  const response = await fetch(SEARCH_URL, {
+  const response = await egress.fetch(SEARCH_URL, {
     method: "POST",
     headers: {
       Authorization: `Bearer ${apiKey}`,