one-code-extension 0.1.4 → 0.3.0

package/extensions/lib/worktree-isolation.ts

@@ -0,0 +1,170 @@
+/**
+ * Worktree isolation for in-process agent runs (`isolation: "worktree"` on the
+ * Agent tool and workflow `agent()` calls): a registry of the live isolation
+ * worktrees, and the inline-extension guard that applies the same git-isolation
+ * bash guard an `enter_worktree` session gets (extensions/worktree/guards.ts).
+ *
+ * The registry exists because the association can only resolve at call time:
+ * these worktrees live in tmpdirs (not statically recognizable paths), and the
+ * child loaders are cached and shared across runs with different cwds.
+ * createWorktree/cleanupWorktree (subagents/worktree.ts) register and release
+ * entries; reconstructed run records re-register kept worktrees after a
+ * process restart (subagents/index.ts); the guard resolves each bash call's
+ * cwd against them.
+ *
+ * Module state is deliberate and safe despite jiti isolation: registration
+ * (worktree creation) and lookup (the guard factory) always happen inside the
+ * SAME extension's import graph — the subagents extension, or the workflow
+ * extension via its own module copy — so the state never needs to cross
+ * extensions.
+ */
+
+import { homedir } from "node:os";
+import { isAbsolute, join, relative } from "node:path";
+import type { InlineExtension } from "@earendil-works/pi-coding-agent";
+import { isWithin, isWritingTool, pathArgument, resolveForContainment, toAbsolute } from "../auto-mode/paths.ts";
+import { analyzeShellCommand } from "../auto-mode/shell-analysis.ts";
+import { worktreeBashGuardReason } from "../worktree/guards.ts";
+
+export interface WorktreeIsolation {
+	/** The isolated worktree the run works in. */
+	worktreePath: string;
+	/** Root of the shared checkout the worktree belongs to. */
+	sharedRoot: string;
+	/**
+	 * Both roots in resolved form (macOS /var → /private/var, symlinked
+	 * checkouts), computed once at registration so the per-call write guard
+	 * resolves only the write's own target, not two static roots per tool call.
+	 */
+	resolvedWorktreePath: string;
+	resolvedSharedRoot: string;
+}
+
+/** Build the registry entry for a worktree, resolving both roots once. Exported for tests. */
+export function describeIsolation(worktreePath: string, sharedRoot: string): WorktreeIsolation {
+	return {
+		worktreePath,
+		sharedRoot,
+		resolvedWorktreePath: resolveForContainment(worktreePath) ?? worktreePath,
+		resolvedSharedRoot: resolveForContainment(sharedRoot) ?? sharedRoot,
+	};
+}
+
+/** worktreePath → its isolation record, for every live isolation worktree. */
+const active = new Map<string, WorktreeIsolation>();
+
+export function registerWorktreeIsolation(worktreePath: string, sharedRoot: string): void {
+	active.set(worktreePath, describeIsolation(worktreePath, sharedRoot));
+}
+
+export function releaseWorktreeIsolation(worktreePath: string): void {
+	active.delete(worktreePath);
+}
+
+/** The registered isolation worktree `cwd` lives in, if any. */
+export function worktreeIsolationFor(cwd: string): WorktreeIsolation | undefined {
+	for (const isolation of active.values()) {
+		if (isWithin(isolation.worktreePath, cwd)) return isolation;
+	}
+	return undefined;
+}
+
+/**
+ * Where a write from an isolated run must not land: inside the shared checkout,
+ * outside the worktree. Returns the corresponding worktree path when `target`
+ * is such a path, else undefined (inside the worktree, or outside the
+ * repository altogether — the permission gate still judges those). Shared by
+ * the file-tool guard and the bash write-target guard below. Pure.
+ */
+export function sharedCheckoutWriteTarget(target: string, cwd: string, isolation: WorktreeIsolation, home = homedir()): string | undefined {
+	const { worktreePath, sharedRoot, resolvedWorktreePath, resolvedSharedRoot } = isolation;
+	const absolute = toAbsolute(cwd, target, home);
+	// Fast path: spelled under the worktree as registered — the common case for
+	// every write the model does where it was told to (no syscall).
+	if (isWithin(worktreePath, absolute)) return undefined;
+	// Resolved so a write is judged by where it lands, not how it is spelled.
+	const resolved = resolveForContainment(absolute) ?? absolute;
+	if (isWithin(resolvedWorktreePath, resolved) || !isWithin(resolvedSharedRoot, resolved)) return undefined;
+	// The tail keeps the model's spelling when the path was written under the
+	// shared root as given; the resolved forms are case-folded on darwin, which
+	// would send the model to `a.ts` for a file named `A.ts` on a case-sensitive volume.
+	const spelled = relative(sharedRoot, absolute);
+	const tail = spelled && !spelled.startsWith("..") && !isAbsolute(spelled) ? spelled : relative(resolvedSharedRoot, resolved);
+	return join(worktreePath, tail);
+}
+
+const refusal = (isolation: WorktreeIsolation, what: string, mapped: string): string =>
+	`This agent is isolated in the worktree ${isolation.worktreePath}, but ${what} is in the shared checkout ${isolation.sharedRoot}. ` +
+	`Refusing the write — an isolated agent's changes belong in its own worktree. Write the corresponding path there instead: ${mapped}`;
+
+/**
+ * Refuse a file-tool write (`edit`/`write`/`notebook_edit`) from an isolated
+ * run that lands in the shared checkout: the model was told to work in the
+ * worktree, but a fork inherits a transcript whose every path points at the
+ * main tree, and a named agent's task may quote such paths too. Pure; exported
+ * for tests.
+ */
+export function worktreeWriteGuardReason(input: {
+	toolName: string;
+	target: string | undefined;
+	cwd: string;
+	isolation: WorktreeIsolation;
+	home?: string;
+}): string | undefined {
+	if (!isWritingTool(input.toolName) || !input.target) return undefined;
+	const mapped = sharedCheckoutWriteTarget(input.target, input.cwd, input.isolation, input.home);
+	return mapped ? refusal(input.isolation, input.target, mapped) : undefined;
+}
+
+/**
+ * The same rule for a shell command: every path the command may write
+ * (redirections, `sed -i`/`cp`/`mv`/`tee` positionals, output flags — the
+ * write-target model auto-mode's shell analysis already maintains) is checked
+ * like a file-tool target. Reads of the shared checkout stay allowed: the fork
+ * may need to look at what it inherited. Interpreters (`sed -i`, `perl`,
+ * `python`) are not modelled as writers there, so a write hidden in one reaches
+ * the permission gate and, in auto mode, the classifier instead — steering, not
+ * a sandbox (same contract as extensions/worktree/guards.ts). Pure; exported for tests.
+ */
+export function worktreeBashWriteGuardReason(input: { command: string; cwd: string; isolation: WorktreeIsolation; home?: string }): string | undefined {
+	const home = input.home ?? homedir();
+	const evidence = analyzeShellCommand({ command: input.command, cwd: input.cwd, home });
+	for (const write of evidence.writes) {
+		const mapped = sharedCheckoutWriteTarget(write.token, input.cwd, input.isolation, home);
+		if (mapped) return refusal(input.isolation, `this command writes to ${write.token}, which`, mapped);
+	}
+	return undefined;
+}
+
+/**
+ * The git-isolation guard for worktree-isolated child sessions, as its own
+ * inline extension so it loads AHEAD of the permission gate — the same
+ * guard-before-permissions layering the main session gets from extension load
+ * order (worktree before permissions, findings §3). buildAgentLoader places it
+ * first in `extensionFactories`; keep it there. Three checks: bash git operations
+ * must target the worktree (extensions/worktree/guards.ts), and writes — by file
+ * tool or by shell command — must land in it.
+ */
+export function worktreeGuardFactory(cwd: string): InlineExtension {
+	return {
+		name: "agent-worktree-guard",
+		hidden: true,
+		factory: (pi) => {
+			pi.on("tool_call", (event, ctx) => {
+				const runCwd = ctx?.cwd ?? cwd;
+				const isolation = worktreeIsolationFor(runCwd);
+				if (!isolation) return undefined;
+				const input = (event.input ?? {}) as Record<string, unknown>;
+				if (event.toolName === "bash") {
+					if (typeof input.command !== "string") return undefined;
+					const reason =
+						worktreeBashGuardReason({ command: input.command, worktreePath: isolation.worktreePath, sharedRoot: isolation.sharedRoot }) ??
+						worktreeBashWriteGuardReason({ command: input.command, cwd: runCwd, isolation });
+					return reason ? { block: true, reason } : undefined;
+				}
+				const reason = worktreeWriteGuardReason({ toolName: event.toolName, target: pathArgument(input), cwd: runCwd, isolation });
+				return reason ? { block: true, reason } : undefined;
+			});
+		},
+	};
+}

package/extensions/lsp/client.ts

@@ -20,15 +20,41 @@ import { readFileSync } from "node:fs";
 import { pathToFileURL } from "node:url";
 import type { LspDiagnostic } from "./format.ts";
 import { createReaderState, encodeMessage, type JsonRpcMessage, readMessages } from "./protocol.ts";
-import type { ServerConfig } from "./servers.ts";
 
 const INITIALIZE_TIMEOUT_MS = 15_000;
 const DIAGNOSTICS_TIMEOUT_MS = 6_000;
 
+/** What a client actually needs to spawn — the built-in table's ServerConfig satisfies it. */
+export interface SpawnConfig {
+	command: string;
+	args: string[];
+}
+
+/** Per-server extras a plugin config can carry (built-in servers pass none). */
+export interface LspClientOptions {
+	/** Merged over process.env at spawn. */
+	env?: Record<string, string>;
+	/** Sent in the `initialize` request. */
+	initializationOptions?: unknown;
+	/** Answers the server's workspace/configuration requests. */
+	settings?: unknown;
+	startupTimeoutMs?: number;
+}
+
 export function pathToUri(path: string): string {
 	return pathToFileURL(path).toString();
 }
 
+/**
+ * The reply to a server's workspace/configuration request: one settings object
+ * per requested item (LSP 3.6 shape), `{}` when none are configured.
+ */
+export function configurationResponse(settings: unknown, params: unknown): unknown[] {
+	const items = (params as { items?: unknown[] } | undefined)?.items;
+	const count = Array.isArray(items) && items.length > 0 ? items.length : 1;
+	return Array.from({ length: count }, () => settings ?? {});
+}
+
 function unrefStream(stream: unknown): void {
 	(stream as { unref?: () => void } | null | undefined)?.unref?.();
 }
@@ -48,11 +74,12 @@ export class LspClient {
 	private open = new Map<string, OpenDocument>();
 	private ready = false;
 	private failure?: string;
+	private publishes = 0;
 
 	constructor(
-		readonly languageId: string,
-		private readonly config: ServerConfig,
+		private readonly config: SpawnConfig,
 		private readonly root: string,
+		private readonly options: LspClientOptions = {},
 	) {}
 
 	get isRunning(): boolean {
@@ -75,7 +102,7 @@ export class LspClient {
 		const child = spawn(this.config.command, this.config.args, {
 			cwd: this.root,
 			stdio: ["pipe", "pipe", "pipe"],
-			env: process.env,
+			env: this.options.env ? { ...process.env, ...this.options.env } : process.env,
 		});
 		this.child = child;
 
@@ -98,6 +125,12 @@ export class LspClient {
 			this.failure = `Could not start ${this.config.command}: ${error.message}`;
 			this.rejectAll(new Error(this.failure));
 		});
+		// A write to a dead server's stdin is an EPIPE on the stream; without a
+		// listener that is an unhandled 'error' event, i.e. a crash (review T10).
+		child.stdin?.on("error", (error) => {
+			this.failure ??= `${this.config.command} stopped accepting input: ${error.message}`;
+			this.ready = false;
+		});
 		child.on("exit", (code, signal) => {
 			this.ready = false;
 			if (!this.failure && code !== 0) {
@@ -113,6 +146,7 @@ export class LspClient {
 				processId: process.pid,
 				rootUri: pathToUri(this.root),
 				workspaceFolders: [{ uri: pathToUri(this.root), name: "workspace" }],
+				initializationOptions: this.options.initializationOptions,
 				capabilities: {
 					textDocument: {
 						synchronization: { dynamicRegistration: false, didSave: false },
@@ -121,7 +155,7 @@ export class LspClient {
 					workspace: { workspaceFolders: true, configuration: true },
 				},
 			},
-			INITIALIZE_TIMEOUT_MS,
+			this.options.startupTimeoutMs ?? INITIALIZE_TIMEOUT_MS,
 		);
 
 		this.notify("initialized", {});
@@ -131,6 +165,7 @@ export class LspClient {
 	private handle(message: JsonRpcMessage): void {
 		if (message.method === "textDocument/publishDiagnostics") {
 			const params = message.params as { uri: string; diagnostics: LspDiagnostic[] };
+			this.publishes++;
 			this.diagnostics.set(params.uri, params.diagnostics ?? []);
 			const waiting = this.waiters.get(params.uri);
 			if (waiting) {
@@ -142,7 +177,10 @@ export class LspClient {
 
 		// Requests from the server: answer the ones that block startup.
 		if (message.id !== undefined && message.method) {
-			const result = message.method === "workspace/configuration" ? [{}] : null;
+			const result =
+				message.method === "workspace/configuration"
+					? configurationResponse(this.options.settings, message.params)
+					: null;
 			this.send({ id: message.id, result });
 			return;
 		}
@@ -193,8 +231,12 @@ export class LspClient {
 		this.waiters.clear();
 	}
 
-	/** Push the file's current on-disk content and return its uri. */
-	syncFile(path: string): string {
+	/**
+	 * Push the file's current on-disk content and return its uri. `languageId`
+	 * is per-document: one plugin server process can map different extensions to
+	 * different language ids.
+	 */
+	syncFile(path: string, languageId: string): string {
 		const uri = pathToUri(path);
 		let text: string;
 		try {
@@ -207,7 +249,7 @@ export class LspClient {
 		if (!existing) {
 			this.open.set(uri, { version: 1, text });
 			this.notify("textDocument/didOpen", {
-				textDocument: { uri, languageId: this.languageId, version: 1, text },
+				textDocument: { uri, languageId, version: 1, text },
 			});
 		} else if (existing.text !== text) {
 			const version = existing.version + 1;
@@ -240,10 +282,10 @@ export class LspClient {
 	 * nothing when a file is unchanged, hence the timeout plus last-known
 	 * fallback.
 	 */
-	async getDiagnostics(path: string, timeoutMs = DIAGNOSTICS_TIMEOUT_MS): Promise<LspDiagnostic[]> {
+	async getDiagnostics(path: string, languageId: string, timeoutMs = DIAGNOSTICS_TIMEOUT_MS): Promise<LspDiagnostic[]> {
 		const uri = pathToUri(path);
 		const hadContent = this.open.get(uri)?.text;
-		const synced = this.syncFile(path);
+		const synced = this.syncFile(path, languageId);
 		const changed = this.open.get(uri)?.text !== hadContent;
 
 		if (changed || !this.diagnostics.has(synced)) {
@@ -252,17 +294,32 @@ export class LspClient {
 		return this.diagnostics.get(synced) ?? [];
 	}
 
+	/** Everything the server has published, per document uri (for the watcher). */
+	allDiagnostics(): Map<string, LspDiagnostic[]> {
+		return new Map(this.diagnostics);
+	}
+
+	/**
+	 * Monotonic count of publishDiagnostics received — the watcher's cheap
+	 * "anything new since last look?" check, so the per-tool-round delta scan
+	 * only runs when a server actually republished.
+	 */
+	get publishCount(): number {
+		return this.publishes;
+	}
+
 	async stop(): Promise<void> {
 		const child = this.child;
 		if (!child) return;
-		this.child = undefined;
 		this.ready = false;
 		try {
+			// Send while this.child is still set — send() writes through it.
 			this.send({ id: this.nextId++, method: "shutdown", params: null });
 			this.notify("exit", null);
 		} catch {
 			// Server may already be gone.
 		}
+		this.child = undefined;
 		await new Promise<void>((resolve) => {
 			const timer = setTimeout(() => {
 				child.kill("SIGKILL");

package/extensions/lsp/format.ts

@@ -12,10 +12,20 @@ export interface LspDiagnostic {
 
 export type SeverityFilter = "error" | "warning" | "all";
 
-const SEVERITY_NAMES: Record<number, string> = { 1: "error", 2: "warning", 3: "info", 4: "hint" };
+/** LSP severity metadata (1..4; missing severity is treated as error). */
+export const SEVERITY: Record<number, { name: string; symbol: string }> = {
+	1: { name: "error", symbol: "✘" },
+	2: { name: "warning", symbol: "⚠" },
+	3: { name: "info", symbol: "ℹ" },
+	4: { name: "hint", symbol: "★" },
+};
 
 export function severityName(severity: number | undefined): string {
-	return SEVERITY_NAMES[severity ?? 1] ?? "error";
+	return SEVERITY[severity ?? 1]?.name ?? "error";
+}
+
+export function severitySymbol(severity: number | undefined): string {
+	return SEVERITY[severity ?? 1]?.symbol ?? "✘";
 }
 
 export function filterDiagnostics(diagnostics: LspDiagnostic[], filter: SeverityFilter): LspDiagnostic[] {