@xynogen/pix-runtime 0.10.2 → 0.13.0

package/src/safe-path.ts

@@ -0,0 +1,101 @@
+/**
+ * safe-path.ts — pre-flight check before a tool writes to a model-chosen path.
+ *
+ * The rules differ per OS: system dirs, path separators, and case. Callers get
+ * one call and a reason they can show to the model.
+ */
+
+import { constants as fsConstants } from "node:fs";
+import { access, lstat } from "node:fs/promises";
+import { posix, win32 } from "node:path";
+import { homeDir } from "./paths.ts";
+import { currentPlatform, type HostPlatform } from "./platform.ts";
+
+export type PathValidation = { ok: true; path: string } | { ok: false; reason: string };
+
+export interface SafePathOptions {
+	env?: NodeJS.ProcessEnv;
+	host?: HostPlatform;
+}
+
+/** Absolute prefixes that never get tool output, for this host. */
+export function sensitivePrefixes(opts: SafePathOptions = {}): string[] {
+	const host = opts.host ?? currentPlatform();
+	const env = opts.env ?? process.env;
+	const p = host.os === "win32" ? win32 : posix;
+	const home = homeDir(env, host.os);
+	const secrets = [".ssh", ".aws", ".gnupg", p.join(".config", "gh")].map((d) => p.join(home, d));
+	if (host.os !== "win32") return ["/etc", "/proc", "/sys", "/boot", ...secrets];
+	const sys = [env.SystemRoot ?? "C:\\Windows", env.ProgramFiles, env["ProgramFiles(x86)"]];
+	const appData = env.APPDATA ?? p.join(home, "AppData", "Roaming");
+	return [...sys, p.join(appData, "GitHub CLI"), ...secrets].filter((d): d is string => !!d);
+}
+
+/** True when `path` is `prefix` or inside it. Case-insensitive on Windows. */
+function isUnder(path: string, prefix: string, host: HostPlatform): boolean {
+	const p = host.os === "win32" ? win32 : posix;
+	// win32.relative already compares case-insensitively.
+	const rel = p.relative(p.resolve(prefix), p.resolve(path));
+	return rel !== ".." && !rel.startsWith(`..${p.sep}`) && !p.isAbsolute(rel);
+}
+
+/**
+ * Rejects null bytes, sensitive system locations, symlinks (target or any
+ * existing parent — Windows junctions count), existing directories, and paths
+ * with no writable existing ancestor.
+ */
+export async function validateOutputPath(
+	absPath: string,
+	opts: SafePathOptions = {},
+): Promise<PathValidation> {
+	const host = opts.host ?? currentPlatform();
+	const p = host.os === "win32" ? win32 : posix;
+	if (absPath.includes("\0")) return { ok: false, reason: "path contains a null byte" };
+	// `\\?\C:\Windows\x` and `\\.\C:\...` reach the same files as `C:\Windows\x`, but
+	// win32.relative() sees another root, so isUnder() would miss them. Normal
+	// output paths never need a device or namespace prefix.
+	if (host.os === "win32" && /^[\\/]{2}[?.][\\/]|^\\\?\?\\/.test(absPath))
+		return { ok: false, reason: `refusing a Windows device or namespace path: ${absPath}` };
+
+	for (const prefix of sensitivePrefixes({ ...opts, host })) {
+		if (isUnder(absPath, prefix, host))
+			return { ok: false, reason: `refusing to write under ${prefix}` };
+	}
+
+	// lstat does not follow symlinks. That is the point here.
+	try {
+		const st = await lstat(absPath);
+		if (st.isSymbolicLink()) return { ok: false, reason: `target is a symlink: ${absPath}` };
+		if (st.isDirectory())
+			return { ok: false, reason: `target is an existing directory: ${absPath}` };
+	} catch (err) {
+		if ((err as NodeJS.ErrnoException).code !== "ENOENT")
+			return { ok: false, reason: `cannot stat target: ${(err as Error).message}` };
+	}
+
+	// Every existing ancestor must not be a symlink (stops a safe-looking dir → /etc
+	// redirect). The nearest one must be writable so mkdir -p works.
+	const parent = p.dirname(absPath);
+	let nearest: string | null = null;
+	for (let cursor = parent; cursor !== p.dirname(cursor); cursor = p.dirname(cursor)) {
+		let st: Awaited<ReturnType<typeof lstat>>;
+		try {
+			st = await lstat(cursor);
+		} catch (err) {
+			if ((err as NodeJS.ErrnoException).code === "ENOENT") continue;
+			return { ok: false, reason: `cannot stat parent: ${(err as Error).message}` };
+		}
+		if (st.isSymbolicLink()) return { ok: false, reason: `parent is a symlink: ${cursor}` };
+		if (st.isDirectory() && nearest === null) nearest = cursor;
+	}
+	if (nearest === null)
+		return { ok: false, reason: `no existing ancestor directory for ${parent}` };
+	try {
+		// ponytail: W_OK reads only the read-only attribute on Windows, not ACLs.
+		// A denied ACL still fails later at mkdir/writeFile with a clear EPERM.
+		await access(nearest, fsConstants.W_OK);
+	} catch {
+		return { ok: false, reason: `no writable ancestor directory: ${nearest}` };
+	}
+	return { ok: true, path: absPath };
+}

package/src/sections/index.ts

@@ -30,6 +30,18 @@ import { ioSection } from "./io.ts";
 import { optimizerSection } from "./optimizer.ts";
 import { prettySection } from "./pretty.ts";
 
+export {
+	fetchSection,
+	searchSection,
+	type ToolboxConfig,
+	toolboxSection,
+	type VoiceConfig,
+	voiceSection,
+	type WebConfig,
+} from "./services.ts";
+
+import { fetchSection, searchSection, toolboxSection, voiceSection } from "./services.ts";
+
 /** All built-in sections, in stable registration order. */
 export const builtinSections = [
 	collapseSection,
@@ -38,4 +50,8 @@ export const builtinSections = [
 	optimizerSection,
 	gateSection,
 	compactionSection,
+	fetchSection,
+	searchSection,
+	voiceSection,
+	toolboxSection,
 ] as const;

package/src/sections/pretty.ts

@@ -1,4 +1,4 @@
-import { defineSection, enumOr, isObj, posNumOr } from "../schema.ts";
+import { boolOr, defineSection, enumOr, isObj, posNumOr } from "../schema.ts";
 
 export type IconMode = "nerd" | "unicode" | "ascii";
 export type LsStyle = "grid" | "tree";
@@ -19,6 +19,21 @@ export interface PrettyConfig {
 	maxHighlightChars: number;
 	cacheLimit: number;
 	diff: DiffConfig;
+	footer: Record<
+		| "mode"
+		| "cwd"
+		| "git"
+		| "context"
+		| "model"
+		| "thinking"
+		| "price"
+		| "score"
+		| "statuses"
+		| "tokens"
+		| "cost"
+		| "tps",
+		boolean
+	>;
 }
 
 const ICON_MODES: readonly IconMode[] = ["nerd", "unicode", "ascii"];
@@ -43,15 +58,35 @@ const DEFAULTS: Readonly<PrettyConfig> = {
 	maxHighlightChars: 80_000,
 	cacheLimit: 128,
 	diff: { splitMinWidth: 150, splitMinCodeWidth: 60 },
+	footer: {
+		mode: true,
+		cwd: true,
+		git: true,
+		context: true,
+		model: true,
+		thinking: true,
+		price: true,
+		score: true,
+		statuses: true,
+		tokens: true,
+		cost: true,
+		tps: true,
+	},
 };
 
 export const prettySection = defineSection<"pretty", PrettyConfig>({
 	key: "pretty",
 	defaults: DEFAULTS,
 	parse(raw) {
-		if (!isObj(raw)) return { ...DEFAULTS, diff: { ...DEFAULTS.diff } };
+		if (!isObj(raw)) return structuredClone(DEFAULTS);
 		const rawDiff = isObj(raw.diff) ? raw.diff : {};
+		const rawFooter = isObj(raw.footer) ? raw.footer : {};
+		const footer = { ...DEFAULTS.footer };
+		for (const key of Object.keys(footer) as (keyof typeof footer)[]) {
+			footer[key] = boolOr(rawFooter[key], DEFAULTS.footer[key]);
+		}
 		return {
+			footer,
 			icons: enumOr(raw.icons, ICON_MODES, DEFAULTS.icons),
 			lsStyle: enumOr(raw.lsStyle, LS_STYLES, DEFAULTS.lsStyle),
 			maxRenderWidth: renderSizeOr(raw.maxRenderWidth, DEFAULTS.maxRenderWidth),

package/src/sections/services.ts

@@ -0,0 +1,71 @@
+import { boolOr, defineSection, isObj, strArr } from "../schema.ts";
+
+export interface WebConfig {
+	provider: string;
+	nineRouterModel: string;
+}
+
+const webDefaults: WebConfig = { provider: "auto", nineRouterModel: "exa" };
+function parseWeb(raw: unknown): WebConfig {
+	const item = isObj(raw) ? raw : {};
+	return {
+		provider: typeof item.provider === "string" ? item.provider : webDefaults.provider,
+		nineRouterModel:
+			typeof item.nineRouterModel === "string" ? item.nineRouterModel : webDefaults.nineRouterModel,
+	};
+}
+export const fetchSection = defineSection({ key: "fetch", defaults: webDefaults, parse: parseWeb });
+export const searchSection = defineSection({
+	key: "search",
+	defaults: webDefaults,
+	parse: parseWeb,
+});
+
+const voiceDefaults = {
+	sttProvider: "auto",
+	ttsProvider: "auto",
+	sttNineRouterModel: "dg/nova-3",
+	ttsNineRouterModel: "edge-tts/en-US-AriaNeural",
+	ttsPlay: true,
+	sttDevice: "default",
+	sttLanguage: "auto",
+	sttShortcut: "ctrl+alt+z",
+	sttCleanup: "off",
+};
+export type VoiceConfig = typeof voiceDefaults;
+export const voiceSection = defineSection({
+	key: "voice",
+	defaults: voiceDefaults,
+	parse(raw): VoiceConfig {
+		const item = isObj(raw) ? raw : {};
+		const result = { ...voiceDefaults };
+		for (const key of Object.keys(result) as (keyof VoiceConfig)[]) {
+			if (key === "ttsPlay") result.ttsPlay = boolOr(item.ttsPlay, true);
+			else if (typeof item[key] === "string" && item[key].trim()) result[key] = item[key].trim();
+		}
+		result.sttLanguage = result.sttLanguage.toLowerCase();
+		return result;
+	},
+});
+export interface ToolboxConfig {
+	disabledTools?: string[];
+	loadedTools?: string[];
+	enabledTools?: string[];
+}
+export const toolboxSection = defineSection<"toolbox", ToolboxConfig>({
+	key: "toolbox",
+	defaults: {},
+	parse(raw) {
+		const result: ToolboxConfig = {};
+		if (isObj(raw)) {
+			for (const key of ["disabledTools", "loadedTools", "enabledTools"] as const) {
+				if (
+					Array.isArray(raw[key]) &&
+					raw[key].every((value: unknown) => typeof value === "string")
+				)
+					result[key] = strArr(raw[key]);
+			}
+		}
+		return result;
+	},
+});

package/src/testing.ts

@@ -3,9 +3,9 @@
  * never touch the real agent directory or the process singleton.
  */
 
-import { mkdtempSync, rmSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { mkdtempSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
+import { tempDir } from "./paths.ts";
 import { FileStorage } from "./persistence.ts";
 import { createRuntime, type PixRuntime } from "./runtime.ts";
 
@@ -16,9 +16,25 @@ export interface IsolatedRuntime {
 	cleanup(): void;
 }
 
+/**
+ * True when this process may create symlinks. Windows allows it only in Developer
+ * Mode or as admin (else EPERM). Use it to skip symlink tests: `it.skipIf(!canSymlink())`.
+ */
+export function canSymlink(): boolean {
+	const dir = mkdtempSync(join(tempDir(), "pix-symlink-probe-"));
+	try {
+		symlinkSync(dir, join(dir, "link"), "dir");
+		return true;
+	} catch {
+		return false;
+	} finally {
+		rmSync(dir, { recursive: true, force: true });
+	}
+}
+
 /** Create a runtime backed by a fresh temp directory. */
 export function createIsolatedRuntime(): IsolatedRuntime {
-	const agentDir = mkdtempSync(join(tmpdir(), "pix-runtime-"));
+	const agentDir = mkdtempSync(join(tempDir(), "pix-runtime-"));
 	const runtime = createRuntime({ agentDir, storage: new FileStorage(agentDir) });
 	return {
 		runtime,

package/src/user-shell.ts

@@ -0,0 +1,51 @@
+/**
+ * user-shell.ts — pick the shell for user `!` commands, per OS.
+ *
+ * - Windows: PowerShell (Pi resolves pwsh 7, else powershell.exe 5.1). Pi's
+ *   default is Git Bash, which is not what a Windows user types into `!`.
+ * - POSIX: $SHELL when it is not bash. zsh also needs rc + aliases: `zsh -c`
+ *   is non-interactive and resolves aliases at parse time, so we source
+ *   .zshrc and then `eval` the command to get a fresh parse boundary.
+ */
+
+import { homeDir } from "./paths.ts";
+import { currentPlatform, type HostPlatform } from "./platform.ts";
+
+export type UserShell =
+	| { kind: "powershell"; wrap(command: string): string }
+	| { kind: "posix"; shellPath: string; wrap(command: string): string };
+
+export interface UserShellOptions {
+	host?: HostPlatform;
+	shell?: string;
+	home?: string;
+}
+
+/** Guarded: `$PSStyle` exists only in PowerShell 7.2+. Strips ANSI color from output. */
+// ponytail: duplicated from pix-powershell (Package Independence). One line, keep both in sync.
+export const PLAIN_TEXT_PREAMBLE = "if ($PSStyle) { $PSStyle.OutputRendering = 'PlainText' }\n";
+
+/** Single-quote a string for POSIX shell embedding. */
+function quote(s: string): string {
+	return `'${s.replace(/'/g, "'\\''")}'`;
+}
+
+export function userShell(opts: UserShellOptions = {}): UserShell | undefined {
+	const host = opts.host ?? currentPlatform();
+	// ponytail: no opt-out back to Git Bash on Windows. Add a pix.json knob on request.
+	if (host.os === "win32") {
+		return { kind: "powershell", wrap: (command) => `${PLAIN_TEXT_PREAMBLE}${command}` };
+	}
+	const shell = "shell" in opts ? opts.shell : process.env.SHELL;
+	if (!shell) return undefined;
+	const name = shell.split("/").pop() ?? "";
+	if (name === "bash") return undefined;
+	if (name !== "zsh") return { kind: "posix", shellPath: shell, wrap: (command) => command };
+	// ponytail: only zsh gets rc wrapping. fish/nu run with shellPath alone. Add their rc logic on request.
+	const rc = quote(`${opts.home ?? homeDir()}/.zshrc`);
+	return {
+		kind: "posix",
+		shellPath: shell,
+		wrap: (command) => `. ${rc} 2>/dev/null; eval ${quote(command)}`,
+	};
+}

package/src/which.ts

@@ -16,15 +16,24 @@
 import { accessSync, constants, statSync } from "node:fs";
 import { access, stat } from "node:fs/promises";
 import { delimiter, isAbsolute, join, sep } from "node:path";
+import { currentPlatform } from "./platform.ts";
 
-const isWindows = process.platform === "win32";
+const isWindows = currentPlatform().os === "win32";
 
 /** Windows executable extensions, from `PATHEXT` with a sane fallback. */
 function pathExtensions(env: NodeJS.ProcessEnv): string[] {
 	if (!isWindows) return [""];
 	const raw = env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD";
-	// Leading "" lets an already-suffixed name (foo.exe) match as-is.
-	return ["", ...raw.split(";").filter(Boolean)];
+	// Leading "" lets an already-suffixed name (foo.exe) match as-is. Lowercased:
+	// NTFS matches either case, and the returned path should read `rtk.exe`, not
+	// `rtk.EXE`, since that is how the files are conventionally named.
+	return [
+		"",
+		...raw
+			.split(";")
+			.filter(Boolean)
+			.map((ext) => ext.toLowerCase()),
+	];
 }
 
 /** Directories to scan, from `PATH`. Windows also probes the current directory first. */
@@ -40,7 +49,15 @@ export interface FindExecutableOptions {
 }
 
 function candidatesFor(name: string, env: NodeJS.ProcessEnv): string[] {
-	const exts = pathExtensions(env);
+	let exts = pathExtensions(env);
+	// Windows cannot spawn an extensionless file (npm ships a `npm` sh script
+	// beside `npm.cmd`), so only accept the bare name when it already carries a
+	// PATHEXT extension.
+	if (isWindows) {
+		const lower = name.toLowerCase();
+		const suffixed = exts.some((ext) => ext && lower.endsWith(ext));
+		exts = suffixed ? [""] : exts.filter(Boolean);
+	}
 	const withExts = (base: string): string[] => exts.map((ext) => base + ext);
 	// A name with a separator (or absolute) is a direct path — do not scan PATH.
 	if (isAbsolute(name) || name.includes(sep) || (isWindows && name.includes("/"))) {