@vtstech/pi-shared 1.2.0 → 1.2.1

package/ollama.js

@@ -12,7 +12,7 @@ function debugLog(module, message, ...args) {
 }
 
 // shared/ollama.ts
-var EXTENSION_VERSION = "1.2.0";
+var EXTENSION_VERSION = "1.2.1";
 var MODELS_JSON_PATH = path.join(os.homedir(), ".pi", "agent", "models.json");
 var _modelsJsonCache = null;
 var _ollamaBaseUrlCache = null;
@@ -249,13 +249,13 @@ function detectModelFamily(modelName) {
   }
   return "unknown";
 }
-function detectProvider(ctx) {
+function detectProvider(ctx, modelsJson) {
   const model = ctx.model;
   if (!model) return { kind: "unknown", name: "none" };
   const providerName = model.provider || "";
   if (!providerName) return { kind: "unknown", name: "none" };
-  const modelsJson = readModelsJson();
-  const userProviderCfg = (modelsJson.providers || {})[providerName];
+  const effectiveModelsJson = modelsJson ?? readModelsJson();
+  const userProviderCfg = (effectiveModelsJson.providers || {})[providerName];
   if (userProviderCfg) {
     const baseUrl = userProviderCfg.baseUrl || "";
     const apiMode = userProviderCfg.api || "";

package/package.json

@@ -1,10 +1,11 @@
 {
   "name": "@vtstech/pi-shared",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "description": "Shared utilities for Pi Coding Agent extensions",
   "exports": {
     "./config-io": "./config-io.js",
     "./debug": "./debug.js",
+    "./errors": "./errors.js",
     "./format": "./format.js",
     "./model-test-utils": "./model-test-utils.js",
     "./ollama": "./ollama.js",
@@ -14,7 +15,7 @@
     "./test-report": "./test-report.js",
     "./types": "./types.js"
   },
-  "keywords": ["pi-extensions"],
+  "keywords": ["pi-package", "pi", "pi-coding-agent", "pi-extensions"],
   "license": "MIT",
   "access": "public",
   "type": "module",

package/security.js

@@ -1,5 +1,5 @@
 // shared/security.ts
-import * as fs from "node:fs";
+import * as fs2 from "node:fs";
 import * as path2 from "node:path";
 import os2 from "node:os";
 
@@ -15,9 +15,22 @@ function debugLog(module, message, ...args) {
 import dns from "node:dns";
 
 // shared/config-io.ts
+import * as fs from "node:fs";
 import * as path from "node:path";
 import os from "node:os";
 var PI_AGENT_DIR = path.join(os.homedir(), ".pi", "agent");
+function writeJsonConfig(filePath, data) {
+  const dir = path.dirname(filePath);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  const content = JSON.stringify(data, null, 2) + "\n";
+  const tmpPath = filePath + ".tmp";
+  try {
+    fs.writeFileSync(tmpPath, content, "utf-8");
+    fs.renameSync(tmpPath, filePath);
+  } catch {
+    fs.writeFileSync(filePath, content, "utf-8");
+  }
+}
 var SETTINGS_PATH = path.join(PI_AGENT_DIR, "settings.json");
 var SECURITY_PATH = path.join(PI_AGENT_DIR, "security.json");
 var REACT_MODE_PATH = path.join(PI_AGENT_DIR, "react-mode.json");
@@ -26,27 +39,42 @@ var MODEL_TEST_CONFIG_PATH = path.join(PI_AGENT_DIR, "model-test-config.json");
 // shared/security.ts
 var SETTINGS_PATH2 = SETTINGS_PATH;
 var SECURITY_CONFIG_PATH = SECURITY_PATH;
+var securityModeCache = null;
+var securityModeCacheTime = 0;
+var SECURITY_CACHE_DURATION_MS = 3e4;
 function getSecurityMode() {
+  const now = Date.now();
+  if (securityModeCache && now - securityModeCacheTime < SECURITY_CACHE_DURATION_MS) {
+    return securityModeCache;
+  }
   try {
-    if (!fs.existsSync(SECURITY_CONFIG_PATH)) return "max";
-    const raw = fs.readFileSync(SECURITY_CONFIG_PATH, "utf-8");
+    if (!fs2.existsSync(SECURITY_CONFIG_PATH)) {
+      securityModeCache = "max";
+      securityModeCacheTime = now;
+      return "max";
+    }
+    const raw = fs2.readFileSync(SECURITY_CONFIG_PATH, "utf-8");
     const config = JSON.parse(raw);
-    if (config.mode === "basic" || config.mode === "max") return config.mode;
+    if (config.mode === "basic" || config.mode === "max" || config.mode === "off") {
+      securityModeCache = config.mode;
+      securityModeCacheTime = now;
+      return config.mode;
+    }
+    securityModeCache = "max";
+    securityModeCacheTime = now;
     return "max";
   } catch (err) {
     debugLog("security", `failed to read security config at ${SECURITY_CONFIG_PATH}`, err);
+    securityModeCache = "max";
+    securityModeCacheTime = now;
     return "max";
   }
 }
 function setSecurityMode(mode) {
-  const configDir = path2.dirname(SECURITY_CONFIG_PATH);
   try {
-    if (!fs.existsSync(configDir)) {
-      fs.mkdirSync(configDir, { recursive: true });
-    }
     const config = { mode, lastUpdated: (/* @__PURE__ */ new Date()).toISOString() };
-    fs.writeFileSync(SECURITY_CONFIG_PATH, JSON.stringify(config, null, 2), "utf-8");
-    const verify = JSON.parse(fs.readFileSync(SECURITY_CONFIG_PATH, "utf-8"));
+    writeJsonConfig(SECURITY_CONFIG_PATH, config);
+    const verify = JSON.parse(fs2.readFileSync(SECURITY_CONFIG_PATH, "utf-8"));
     if (verify.mode !== mode) {
       debugLog("security", `security config write verification failed: expected ${mode}, got ${verify.mode}`);
       return false;
@@ -235,7 +263,7 @@ function validatePath(filePath, allowedDirs) {
   try {
     resolved = path2.resolve(filePath);
     try {
-      resolved = fs.realpathSync(resolved);
+      resolved = fs2.realpathSync(resolved);
     } catch {
     }
   } catch {
@@ -328,7 +356,7 @@ async function resolveAndCheckHostname(hostname, blockPrivate = true) {
     return { safe: true, error: "" };
   }
 }
-function isSafeUrl(url, blockSsrf = true) {
+function isSafeUrl(url, blockSsrf = true, mode = "max") {
   if (!url) return { safe: false, error: "URL cannot be empty" };
   let parsed;
   try {
@@ -353,7 +381,9 @@ function isSafeUrl(url, blockSsrf = true) {
     return { safe: false, error: "URL hostname uses non-decimal IP format" };
   }
   if (blockSsrf) {
-    const mode = getSecurityMode();
+    if (mode === "off") {
+      return { safe: true, error: "" };
+    }
     for (const pattern of BLOCKED_URL_ALWAYS) {
       if (normalized === pattern || normalized.endsWith("." + pattern) || normalized.startsWith(pattern)) {
         if (/^\d|^::/.test(pattern)) {
@@ -477,11 +507,11 @@ function ensureAuditFlushTimer() {
 function flushAuditBuffer() {
   if (_auditBuffer.length === 0) return;
   try {
-    if (!fs.existsSync(AUDIT_DIR)) {
-      fs.mkdirSync(AUDIT_DIR, { recursive: true });
+    if (!fs2.existsSync(AUDIT_DIR)) {
+      fs2.mkdirSync(AUDIT_DIR, { recursive: true });
     }
     const batch = _auditBuffer.join("");
-    fs.appendFileSync(AUDIT_LOG_PATH, batch, "utf-8");
+    fs2.appendFileSync(AUDIT_LOG_PATH, batch, "utf-8");
   } catch (err) {
     debugLog("security", "audit buffer flush failure", err);
   }
@@ -492,12 +522,12 @@ function appendAuditEntry(entry) {
     ensureAuditFlushTimer();
     const AUDIT_LOG_MAX_SIZE = 5 * 1024 * 1024;
     try {
-      if (fs.existsSync(AUDIT_LOG_PATH)) {
-        const stat = fs.statSync(AUDIT_LOG_PATH);
+      if (fs2.existsSync(AUDIT_LOG_PATH)) {
+        const stat = fs2.statSync(AUDIT_LOG_PATH);
         if (stat.size > AUDIT_LOG_MAX_SIZE) {
           const entries = readRecentAuditEntries(1e3);
           const content = entries.map((e) => JSON.stringify(e)).join("\n") + "\n";
-          fs.writeFileSync(AUDIT_LOG_PATH, content, "utf-8");
+          fs2.writeFileSync(AUDIT_LOG_PATH, content, "utf-8");
         }
       }
     } catch (err) {
@@ -515,10 +545,10 @@ function appendAuditEntry(entry) {
 }
 function readRecentAuditEntries(count = 50) {
   try {
-    if (!fs.existsSync(AUDIT_LOG_PATH)) return [];
-    const fileSize = fs.statSync(AUDIT_LOG_PATH).size;
+    if (!fs2.existsSync(AUDIT_LOG_PATH)) return [];
+    const fileSize = fs2.statSync(AUDIT_LOG_PATH).size;
     if (fileSize === 0) return [];
-    const fd = fs.openSync(AUDIT_LOG_PATH, "r");
+    const fd = fs2.openSync(AUDIT_LOG_PATH, "r");
     const bufferSize = 8192;
     const buffer = Buffer.alloc(bufferSize);
     const lines = [];
@@ -527,7 +557,7 @@ function readRecentAuditEntries(count = 50) {
     while (pos > 0 && lines.length < count) {
       const readSize = Math.min(bufferSize, pos);
       pos -= readSize;
-      fs.readSync(fd, buffer, 0, readSize, pos);
+      fs2.readSync(fd, buffer, 0, readSize, pos);
       const chunk = buffer.slice(0, readSize).toString("utf-8");
       partial = chunk + partial;
       const lineBreak = partial.lastIndexOf("\n");
@@ -537,7 +567,7 @@ function readRecentAuditEntries(count = 50) {
         partial = partial.slice(0, lineBreak);
       }
     }
-    fs.closeSync(fd);
+    fs2.closeSync(fd);
     if (partial.trim() && lines.length < count) {
       lines.unshift(partial);
     }
@@ -560,16 +590,18 @@ process.on("exit", () => {
 process.on("SIGTERM", () => {
   flushAuditBuffer();
 });
-function checkBashToolInput(input) {
+function checkBashToolInput(input, mode = "max") {
+  if (mode === "off") return { safe: true, rule: "", detail: "" };
   const command = input.command ?? input.cmd ?? "";
   if (!command) return { safe: true, rule: "", detail: "" };
-  const result = sanitizeCommand(command);
+  const result = sanitizeCommand(command, mode);
   if (!result.isSafe) {
     return { safe: false, rule: "command_blocklist", detail: result.error };
   }
   return { safe: true, rule: "", detail: "" };
 }
-function checkFileToolInput(input) {
+function checkFileToolInput(input, mode = "max") {
+  if (mode === "off") return { safe: true, rule: "", detail: "" };
   const filePaths = [
     input.file_path,
     input.path,
@@ -585,16 +617,18 @@ function checkFileToolInput(input) {
   }
   return { safe: true, rule: "", detail: "" };
 }
-function checkHttpToolInput(input) {
+function checkHttpToolInput(input, mode = "max") {
+  if (mode === "off") return { safe: true, rule: "", detail: "" };
   const url = input.url ?? input.uri ?? input.endpoint ?? "";
   if (!url) return { safe: true, rule: "", detail: "" };
-  const result = isSafeUrl(url);
+  const result = isSafeUrl(url, mode);
   if (!result.safe) {
     return { safe: false, rule: "ssrf_protection", detail: result.error };
   }
   return { safe: true, rule: "", detail: "" };
 }
-function checkInjectionPatterns(input) {
+function checkInjectionPatterns(input, mode = "max") {
+  if (mode === "off") return { safe: true, rule: "", detail: "" };
   const dangerousPatterns = [
     /;\s*(rm|sudo|chmod|chown|mkfs|dd|shred)\b/,
     /\|\s*(rm|sudo|chmod|shred|mkfs)\b/,

package/test-report.js

@@ -29,7 +29,7 @@ import os from "node:os";
 var DEBUG_ENABLED = process.env.PI_EXTENSIONS_DEBUG === "1";
 
 // shared/ollama.ts
-var EXTENSION_VERSION = "1.2.0";
+var EXTENSION_VERSION = "1.2.1";
 var MODELS_JSON_PATH = path.join(os.homedir(), ".pi", "agent", "models.json");
 
 // shared/test-report.ts