@wardby/cli 0.5.2 → 0.5.3

package/dist/coding/local-git.js

@@ -72,7 +72,15 @@ export async function localGitWrite(dir, args, options = {}) {
     }
     return await new Promise((resolve, reject) => {
         const child = execFile("git", gitArgs(dir, args), { env: { ...cleanGitEnv(), ...extra }, maxBuffer: GIT_MAX_BUFFER, encoding: "utf8" }, (error, stdout) => (error ? reject(error) : resolve(stdout)));
-        child.stdin?.end(options.input ?? "");
+        // git may exit before reading stdin (an early error, or a command that never
+        // reads it); writing to the closed pipe then raises EPIPE on stdin. The
+        // callback above already reports git's own result, so a stdin error is not
+        // the outcome — but left unhandled it would be an uncaught exception.
+        child.stdin?.on("error", () => { });
+        if (options.input === undefined)
+            child.stdin?.end();
+        else
+            child.stdin?.end(options.input);
     });
 }
 /** True for a plain branch/tag name that cannot read as an option or revision expression. */

package/dist/coding/registry/pypi.d.ts

@@ -1,4 +1,28 @@
-import { type RegistryAdapter } from "./types.js";
+import { type FileDependency, type RegistryAdapter } from "./types.js";
+/** The most extras one allowlist entry or dependency line may name. */
+export declare const MAX_EXTRAS = 32;
+export declare function isPypiProjectName(name: string): boolean;
 export declare function normalizePypiName(name: string): string;
+/** Normalized (PEP 685), sorted, de-duplicated extras from the text inside
+ *  `[...]`, or null when any is not a valid extra name (PEP 508: the same
+ *  shape as a project name), the list is empty, or it names too many. */
+export declare function parseExtras(list: string): string[] | null;
+/**
+ * The dependencies a wheel's METADATA declares for an install of the package
+ * with `extras`: every line without an `extra == "…"` marker clause, plus the
+ * lines whose marker names one of `extras` (other marker clauses are ignored,
+ * so a requested extra's lines are included on every platform). A line gated
+ * on any other extra is skipped. Each dependency carries the extras its line
+ * asks of it (`uvicorn[standard]`); a line naming the package itself
+ * (`celery[redis]; extra == "all"`) adds those extras to this install
+ * instead. Names and extras are validated and normalized.
+ *
+ * Policy, not pip: a plain install (no `extras`) follows no extras at all,
+ * neither its own (a self-referencing line) nor its dependencies' — each
+ * dependency comes back bare, so extras are followed only along a chain that
+ * starts at an allowlist entry naming extras.
+ */
+export declare function requiredDists(metadataText: string, extras?: readonly string[]): FileDependency[];
+/** Dependency names a METADATA declares for a plain install (no extras). */
 export declare function requiresDist(metadataText: string): string[];
 export declare const pypiAdapter: RegistryAdapter;

package/dist/coding/registry/pypi.js

@@ -10,7 +10,10 @@ import { unzipSync, strFromU8 } from "fflate";
 import { AllowlistEntryError, RegistryError, } from "./types.js";
 const UPSTREAM = "https://pypi.org/simple/";
 const SIMPLE_JSON = "application/vnd.pypi.simple.v1+json";
-const ENTRY = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(.*)$/;
+/** name, an optional `[extras]` group (checked separately), then the specifier. */
+const ENTRY = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[([^\]]*)\])?\s*(.*)$/;
+/** The most extras one allowlist entry or dependency line may name. */
+export const MAX_EXTRAS = 32;
 const WHEEL_METADATA_LIMIT = 64 * 1024 * 1024;
 function uploadTime(file) {
     const time = file["upload-time"] ? Date.parse(file["upload-time"]) : NaN;
@@ -19,6 +22,9 @@ function uploadTime(file) {
 /** A valid PyPI project name (PEP 508): ASCII letters and digits, with
  *  `.`, `_` and `-` allowed only between them. */
 const PROJECT_NAME = /^(?:[A-Za-z0-9]|[A-Za-z0-9][A-Za-z0-9._-]*[A-Za-z0-9])$/;
+export function isPypiProjectName(name) {
+    return PROJECT_NAME.test(name);
+}
 function decoded(segment) {
     try {
         return decodeURIComponent(segment);
@@ -43,19 +49,132 @@ function versionOf(filename) {
     const sdist = filename.match(/^.+?-(\d[^-]*)\.(?:tar\.gz|zip)$/);
     return sdist ? sdist[1] : null;
 }
-export function requiresDist(metadataText) {
-    const names = new Set();
+/** Normalized (PEP 685), sorted, de-duplicated extras from the text inside
+ *  `[...]`, or null when any is not a valid extra name (PEP 508: the same
+ *  shape as a project name), the list is empty, or it names too many. */
+export function parseExtras(list) {
+    const items = list.split(",").map((item) => item.trim());
+    if (items.length > MAX_EXTRAS || items.some((item) => !PROJECT_NAME.test(item)))
+        return null;
+    return [...new Set(items.map(normalizePypiName))].sort();
+}
+/** The string literals a marker compares `extra` to with `==` or `===`
+ *  (either operand order), normalized; null when the marker never mentions
+ *  `extra`. Tokenized, so a quoted value never counts as a clause. Fails
+ *  closed: when `extra` appears in any shape this does not fully recognise
+ *  (`extra in "a b"`, `extra.x`, a bare `extra`, an unbalanced quote), the
+ *  line is gated on no extra at all, so it is never followed. */
+function markerExtras(marker) {
+    if (!/\bextra\b/.test(marker))
+        return null;
+    const tokens = marker.match(/"[^"]*"|'[^']*'|===|==|!=|<=|>=|~=|[A-Za-z_][A-Za-z0-9_.]*|\S/g) ?? [];
+    const isLiteral = (token) => token !== undefined && token.length >= 2 && (token[0] === '"' || token[0] === "'");
+    const isEquals = (token) => token === "==" || token === "===";
+    // A lone quote (unterminated string) means the marker cannot be read.
+    if (tokens.some((token) => token === '"' || token === "'"))
+        return [];
+    const found = [];
+    let recognised = 0;
+    for (let i = 0; i < tokens.length; i++) {
+        if (tokens[i] !== "extra")
+            continue;
+        let value = null;
+        if (isEquals(tokens[i + 1]) && isLiteral(tokens[i + 2]))
+            value = tokens[i + 2].slice(1, -1);
+        else if (isEquals(tokens[i - 1]) && isLiteral(tokens[i - 2]))
+            value = tokens[i - 2].slice(1, -1);
+        if (value === null)
+            return [];
+        recognised++;
+        if (PROJECT_NAME.test(value))
+            found.push(normalizePypiName(value));
+    }
+    // `extra` only inside quoted values: not a clause, but not one this reads either.
+    return recognised === 0 ? [] : found;
+}
+const REQUIREMENT = /^([A-Za-z0-9][A-Za-z0-9._-]*)\s*(?:\[([^\]]*)\])?/;
+// Splits each Requires-Dist value only at its first `;` (the marker), which is
+// all wheel METADATA needs: no `name @ url` with a `;` in the URL, no comments
+// or line continuations as in a requirements file.
+function requirementLines(metadataText) {
+    let self = null;
+    const lines = [];
     for (const line of metadataText.split(/\r?\n/)) {
+        // The headers end at the first truly empty line; the description
+        // follows. A whitespace-only line is a folded header's continuation.
+        if (line === "")
+            break;
+        if (line.startsWith("Name:")) {
+            const name = line.slice("Name:".length).trim();
+            if (self === null && PROJECT_NAME.test(name))
+                self = normalizePypiName(name);
+            continue;
+        }
         if (!line.startsWith("Requires-Dist:"))
             continue;
         const value = line.slice("Requires-Dist:".length).trim();
-        if (/;\s*.*\bextra\s*==/.test(value))
+        const match = value.match(REQUIREMENT);
+        if (!match || !PROJECT_NAME.test(match[1]))
+            continue;
+        const semicolon = value.indexOf(";", match[0].length);
+        lines.push({
+            name: normalizePypiName(match[1]),
+            // A malformed extras list still installs the package, just none of its extras.
+            extras: match[2] === undefined ? [] : (parseExtras(match[2]) ?? []),
+            gate: semicolon === -1 ? null : markerExtras(value.slice(semicolon + 1)),
+        });
+    }
+    return { self, lines };
+}
+/**
+ * The dependencies a wheel's METADATA declares for an install of the package
+ * with `extras`: every line without an `extra == "…"` marker clause, plus the
+ * lines whose marker names one of `extras` (other marker clauses are ignored,
+ * so a requested extra's lines are included on every platform). A line gated
+ * on any other extra is skipped. Each dependency carries the extras its line
+ * asks of it (`uvicorn[standard]`); a line naming the package itself
+ * (`celery[redis]; extra == "all"`) adds those extras to this install
+ * instead. Names and extras are validated and normalized.
+ *
+ * Policy, not pip: a plain install (no `extras`) follows no extras at all,
+ * neither its own (a self-referencing line) nor its dependencies' — each
+ * dependency comes back bare, so extras are followed only along a chain that
+ * starts at an allowlist entry naming extras.
+ */
+export function requiredDists(metadataText, extras = []) {
+    const { self, lines } = requirementLines(metadataText);
+    const requested = new Set(extras.map(normalizePypiName));
+    const plain = requested.size === 0;
+    const included = (line) => line.gate === null || line.gate.some((extra) => requested.has(extra));
+    for (let grew = !plain; grew;) {
+        grew = false;
+        for (const line of lines) {
+            if (line.name !== self || !included(line))
+                continue;
+            for (const extra of line.extras) {
+                if (requested.size >= MAX_EXTRAS || requested.has(extra))
+                    continue;
+                requested.add(extra);
+                grew = true;
+            }
+        }
+    }
+    const out = new Map();
+    for (const line of lines) {
+        if (line.name === self || !included(line))
             continue;
-        const name = value.match(/^([A-Za-z0-9][A-Za-z0-9._-]*)/);
-        if (name)
-            names.add(normalizePypiName(name[1]));
+        const merged = out.get(line.name) ?? new Set();
+        if (!plain)
+            for (const extra of line.extras)
+                if (merged.size < MAX_EXTRAS)
+                    merged.add(extra);
+        out.set(line.name, merged);
     }
-    return [...names];
+    return [...out].map(([name, merged]) => ({ name, extras: [...merged].sort() }));
+}
+/** Dependency names a METADATA declares for a plain install (no extras). */
+export function requiresDist(metadataText) {
+    return requiredDists(metadataText).map((dependency) => dependency.name);
 }
 export const pypiAdapter = {
     id: "pypi",
@@ -68,12 +187,17 @@ export const pypiAdapter = {
         if (!match)
             throw new AllowlistEntryError(`"${raw}" is not a valid Python package entry`);
         const name = normalizePypiName(match[1]);
-        const range = match[2].trim();
-        if (!range)
-            return { name, wildcard: false };
-        if (!validRange(range))
+        let extras;
+        if (match[2] !== undefined) {
+            const parsed = parseExtras(match[2]);
+            if (!parsed)
+                throw new AllowlistEntryError(`"[${match[2]}]" in "${raw}" is not a valid list of extras (comma-separated names, at most ${MAX_EXTRAS})`);
+            extras = parsed;
+        }
+        const range = match[3].trim();
+        if (range && !validRange(range))
             throw new AllowlistEntryError(`"${range}" is not a valid PEP 440 specifier`);
-        return { name, wildcard: false, range };
+        return { name, wildcard: false, ...(extras ? { extras } : {}), ...(range ? { range } : {}) };
     },
     normalizeName: normalizePypiName,
     satisfies: (version, range) => pepSatisfies(version, range),
@@ -182,14 +306,14 @@ export const pypiAdapter = {
             publishedAt: uploadTime(source),
         };
     },
-    async dependenciesFromFile(route, body) {
+    async dependenciesFromFile(route, body, extras) {
         if (route.kind === "file-metadata")
-            return requiresDist(new TextDecoder().decode(body));
+            return requiredDists(new TextDecoder().decode(body), extras);
         if (!route.filename.endsWith(".whl") || body.byteLength > WHEEL_METADATA_LIMIT)
             return [];
         const entries = unzipSync(body, { filter: (file) => /\.dist-info\/METADATA$/.test(file.name) });
         const metadata = Object.values(entries)[0];
-        return metadata ? requiresDist(strFromU8(metadata)) : [];
+        return metadata ? requiredDists(strFromU8(metadata), extras) : [];
     },
     workerConfig({ registryUrl, token, cacheDir }) {
         const index = new URL("simple/", registryUrl);

package/dist/coding/registry/types.d.ts

@@ -17,6 +17,11 @@ export interface AllowlistEntry {
     wildcard: boolean;
     /** Optional version range in this ecosystem's syntax. */
     range?: string;
+    /** PyPI only: the extras the entry names (`psycopg[binary]`), normalized
+     *  (PEP 685), sorted and de-duplicated. Absent when it names none. Each
+     *  one also allows the dependencies the package's own metadata declares
+     *  under that extra, and nothing else. */
+    extras?: readonly string[];
 }
 export declare class AllowlistEntryError extends Error {
 }
@@ -52,6 +57,12 @@ export interface DependencySpec {
     name: string;
     range: string;
 }
+/** One dependency read from a served file: its name and the extras the
+ *  declaring line asks of it (`uvicorn[standard]`), both normalized. */
+export interface FileDependency {
+    name: string;
+    extras: readonly string[];
+}
 export interface VersionInfo {
     version: string;
     /** Dependency names (normalized). Empty when discovered from files instead. */
@@ -271,10 +282,13 @@ export interface RegistryAdapter {
     /** Map a download route to a file in metadata the proxy fetched itself.
      *  Returns null if the route names no known file. */
     resolveDownload(route: DownloadRoute, meta: PackageMetadata): FileRef | null;
-    /** For ecosystems whose indexes omit dependencies (PyPI): dependency
-     *  names read from a served file or its metadata file. Omitted when
+    /** For ecosystems whose indexes omit dependencies (PyPI): dependencies
+     *  read from a served file or its metadata file. `extras` are the extras
+     *  the run allows for this package (from the allowlist or from a parent's
+     *  dependency line): dependencies the file declares only under one of
+     *  them are included too, and no others. Omitted when
      *  VersionInfo.dependencies is already complete (npm). */
-    dependenciesFromFile?(route: DownloadRoute | FileMetadataRoute, body: Uint8Array): Promise<string[]>;
+    dependenciesFromFile?(route: DownloadRoute | FileMetadataRoute, body: Uint8Array, extras: readonly string[]): Promise<FileDependency[]>;
     /** Map a file-metadata route (PEP 658) to the file it describes, from
      *  metadata the proxy fetched itself. Returns null if the route names no
      *  known file. */

package/dist/config/providers.d.ts

@@ -144,8 +144,9 @@ export interface KubernetesJobConfig {
     preflightTimeoutMs?: number;
     readyTimeoutMs?: number;
     /**
-     * Bound for a single NetworkPolicy-enforcement probe exec (the keeper running two sequential
-     * connects). Defaults to the launcher's own 10 s, which a resource-constrained keeper (e.g. a
+     * Time budget for a single NetworkPolicy-enforcement probe (the keeper running two sequential
+     * connects); a streak's probes share one exec whose timeout the launcher derives from this.
+     * Defaults to the launcher's own 10 s, which a resource-constrained keeper (e.g. a
      * laptop `kind` cluster's default 250m CPU / 128Mi limit) can exceed even though the probe
      * itself is healthy — observed live: raising this to 60_000 was enough on `kind`. GKE Autopilot
      * is unaffected by leaving this unset. The launcher derives its overall enforcement wall-clock

package/dist/core/http-runtime.js

@@ -27,8 +27,14 @@
  * client never did, so the connection is upgraded underneath a fetch
  * implementation that never asked for it. That is why only real APIs broke: the
  * GitHub App client (refusing every coding run before launch), the
- * OpenAI/Anthropic/Bedrock SDKs, and remote-JWKS verification in delegating auth
- * mode. Plain h1 — every local test server — is unaffected.
+ * Anthropic/Bedrock SDKs, and remote-JWKS verification in delegating auth mode.
+ * Plain h1 — every local test server — is unaffected. The OpenAI SDK was NOT
+ * among them at the time: openai@4 shipped its own node-fetch plus an
+ * agentkeepalive agent and never touched the global dispatcher. openai@5+
+ * (wardby pins 7.x) dropped that stack for the built-in `fetch`, so OpenAI
+ * traffic now rides this dispatcher too and depends on it staying h1-only —
+ * `providers/llm/openai.sdk-stream.test.ts` asserts the SDK's requests go
+ * through it.
  *
  * FIX. Keep the built-in `fetch` and give it a dispatcher that stays on the
  * protocol it was written for: undici 8's own `Agent` with `allowH2: false`.
@@ -38,8 +44,9 @@
  *
  * WHY NOT replace the globals. Installing undici's `fetch`/`Headers`/`Response`/
  * `Request`/`FormData` process-wide also works, but it swaps the classes under
- * the MCP SDK, the OpenAI/Anthropic/Bedrock SDKs (all of which brand-check
- * `Headers`/`Response`), `FormData`/`Blob` uploads, `AbortSignal` semantics and
+ * the MCP SDK, the OpenAI (7.x)/Anthropic/Bedrock SDKs (all of which use the
+ * built-in fetch and brand-check `Headers`/`Response`), `FormData`/`Blob`
+ * uploads, `AbortSignal` semantics and
  * every cross-realm `instanceof` — real risk, for no gain over one dispatcher
  * option. It would also move all control-plane egress to h2.
  *
@@ -58,8 +65,8 @@
  * silently restore the corruption — the price of fixing this with a dispatcher
  * instead of owning the fetch stack. Nothing in the runtime image does that
  * today: the only other `setGlobalDispatcher` call in the tree is
- * `node-fetch-native` under the `prisma` CLI, which `deploy/Dockerfile:25`
- * asserts is absent from the runtime image. (Prisma 7's client runtime and
+ * `node-fetch-native` under the `prisma` CLI, which the runtime stage of
+ * `deploy/Dockerfile` asserts is absent. (Prisma 7's client runtime and
  * `@prisma/adapter-pg` contain none; Prisma 6's `runtime/binary.*` did.)
  *
  * Restoring Node's OWN dispatcher instead is not possible, though not for the