one-code-extension 0.4.0 → 0.5.0

package/extensions/lib/tool-call-corruption.ts

@@ -0,0 +1,134 @@
+/**
+ * A streamed tool call's damage. `corrupt` is certain (not one JSON value, a
+ * shell command ending inside an open double quote): the call is blocked and
+ * the turn stopped. `suspect` has the shape of a cut but also of a valid
+ * command (an option followed by one trailing blank): the call goes back to the
+ * model once, and a repeat in the same run counts as corrupt.
+ */
+export interface ToolCallDamage {
+	kind: "corrupt" | "suspect";
+	reason: string;
+}
+
+// The last word is an option followed by one blank, or a long option with an
+// empty `=` value: `grep -rn "x"` and `--include="*.py"` cut at the escaped
+// quote (findings §61, Morph). A bare `FOO=` is a valid assignment.
+const CUT_AFTER_OPTION = /(?:^|\s)(-{1,2}[A-Za-z][\w-]*)[ \t]$|(?:^|\s)(--[A-Za-z][\w-]*=)$/;
+// Heredocs and here-strings (bash `<<`, `<<<`; PowerShell `@"…"@`, `@'…'@`)
+// carry quotes the scan below cannot pair, so it does not judge them.
+const HERE_DOCUMENT = /<<|@["']/;
+
+/** Inspect one tool call's raw streamed arguments before pi's tolerant parsing hides damage. */
+export function toolCallCorruptionReason(toolName: string, rawArguments: string): ToolCallDamage | undefined {
+	// A tool with no parameters may stream no argument text at all; pi reads it as {}.
+	if (rawArguments.trim() === "") return;
+	let args: unknown;
+	try {
+		args = JSON.parse(rawArguments);
+	} catch {
+		return { kind: "corrupt", reason: "The raw tool-call arguments are not exactly one JSON value." };
+	}
+	if (toolName !== "bash" && toolName !== "powershell" && toolName !== "monitor") return;
+	if (!args || typeof args !== "object" || !("command" in args) || typeof args.command !== "string") return;
+	const cut = CUT_AFTER_OPTION.exec(args.command);
+	if (cut) {
+		return {
+			kind: "suspect",
+			reason: `The shell command ends with "${cut[1] ?? cut[2]}" and nothing after it, the shape of arguments cut off before a quoted string.`,
+		};
+	}
+	const command = args.command.trimEnd();
+	if (!command.endsWith('"') || HERE_DOCUMENT.test(command)) return;
+
+	let singleQuoted = false;
+	let doubleQuoted = false;
+	const escape = toolName === "powershell" ? "`" : "\\";
+	for (let i = 0; i < command.length; i++) {
+		const char = command[i];
+		if (singleQuoted) {
+			if (char === "'") singleQuoted = false;
+		} else if (char === escape) {
+			i++;
+		} else if (char === "'" && !doubleQuoted) {
+			singleQuoted = true;
+		} else if (char === '"') {
+			doubleQuoted = !doubleQuoted;
+		} else if (char === "#" && !doubleQuoted && (i === 0 || /[\s;&|(]/.test(command[i - 1]))) {
+			// A comment runs to the end of its line.
+			const newline = command.indexOf("\n", i);
+			if (newline === -1) break;
+			i = newline;
+		}
+	}
+	if (doubleQuoted) return { kind: "corrupt", reason: "The shell command ends with an unbalanced double quote, indicating truncated tool-call arguments." };
+}
+
+// GLM's native tool-call tags, which a broken upstream parser leaks into the JSON arguments.
+const TOOL_CALL_MARKUP = /<\/arg_value>\s{0,8}<arg_key>|<\/arg_key>\s{0,8}<arg_value>|<\/tool_call>\s{0,8}<tool_call>/g;
+const LONGEST_MARKUP = 40;
+
+/** The number of markup matches that marks a streaming call as leaked. */
+export const TOOL_CALL_MARKUP_LIMIT = 2;
+/**
+ * The same inside file content (write, edit, notebook_edit), which can quote
+ * the markup legitimately (this repo's tests do); a leak there repeats without
+ * end and passes it within a few thousand characters.
+ */
+export const CONTENT_MARKUP_LIMIT = 50;
+
+// A string value under one of these keys is file content.
+const CONTENT_KEY = /"(?:content|oldText|newText|new_source)"\s*:\s*$/;
+
+/** Whether `index` sits in a string value under a content key: the nearest unescaped quote before it opens that value. */
+function inContentValue(text: string, index: number): boolean {
+	// lastIndexOf clamps a negative start to 0, so stop before it can repeat a quote at 0.
+	for (let quote = index; quote > 0; ) {
+		quote = text.lastIndexOf('"', quote - 1);
+		if (quote < 0) break;
+		let slashes = 0;
+		while (text[quote - 1 - slashes] === "\\") slashes++;
+		if (slashes % 2 === 0) return CONTENT_KEY.test(text.slice(Math.max(0, quote - 32), quote));
+	}
+	return false;
+}
+
+/**
+ * Count native tool-call markup in `text` from `from` on, for a call whose
+ * arguments are still streaming, apart (`contentCount`) inside file content;
+ * `next` is where the following scan resumes, so each delta is scanned once.
+ */
+export function scanToolCallMarkup(text: string, from: number): { count: number; contentCount: number; next: number } {
+	TOOL_CALL_MARKUP.lastIndex = from;
+	let count = 0;
+	let contentCount = 0;
+	let next = from;
+	for (let match = TOOL_CALL_MARKUP.exec(text); match; match = TOOL_CALL_MARKUP.exec(text)) {
+		if (inContentValue(text, match.index)) contentCount++;
+		else count++;
+		next = TOOL_CALL_MARKUP.lastIndex;
+	}
+	return { count, contentCount, next: Math.max(next, text.length - LONGEST_MARKUP) };
+}
+
+/**
+ * Blank space a tool call may stream after its last argument character before
+ * the stream counts as runaway. Only a run holding a raw tab or newline
+ * counts: inside a JSON string those are escaped, so such a run is padding
+ * between tokens, never argument content (a string may hold any run of spaces).
+ */
+export const RUNAWAY_PADDING_LIMIT = 10_000;
+
+export interface TrailingPadding {
+	run: number;
+	structural: boolean;
+}
+
+/** The trailing blank run after one more streamed delta. */
+export function trailingPadding(previous: TrailingPadding | undefined, delta: string): TrailingPadding {
+	const last = delta.search(/\S\s*$/);
+	if (last < 0) {
+		return { run: (previous?.run ?? 0) + delta.length, structural: (previous?.structural ?? false) || /[\t\n\r]/.test(delta) };
+	}
+	const tail = delta.slice(last + 1);
+	return { run: tail.length, structural: /[\t\n\r]/.test(tail) };
+}

package/extensions/lib/tool-path.ts

@@ -0,0 +1,66 @@
+/**
+ * Resolve a file tool's `path` argument exactly as pi's own `read`, `edit` and
+ * `write` do (`resolveToCwd` in pi-coding-agent's `core/tools/path-utils.js`,
+ * over `utils/paths.js normalizePath`), vendored because the package does not
+ * export it. Anything that reasons about the file a pi tool will touch (the
+ * file tracker's read-before-write and stale-edit guards, our notebook tool,
+ * the worktree rewrite of relative paths) must land on the same file, or a spelling pi accepts (`~/x`, `@x`,
+ * `file:///…`, a non-breaking space, Git Bash's `/c/…` on Windows) slips past
+ * the guard (TOOLS-REVIEW-2026-09-26 M1). Pure: no pi imports.
+ *
+ * Mirrors pi 0.87.1 to 0.99.2: Unicode spaces fold to a plain space, one
+ * leading `@` is dropped, on Windows a Git Bash/MSYS/Cygwin/WSL drive path
+ * becomes `C:\…`, `~` and `~/` expand to the home directory (and `~\` on
+ * Windows), a `file://` URL becomes its path, and a relative result resolves
+ * against `cwd`.
+ */
+
+import { homedir } from "node:os";
+import { isAbsolute, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const UNICODE_SPACES = /[\u00A0\u2000-\u200A\u202F\u205F\u3000]/g;
+
+/** pi's `normalizeWindowsShellPath`: `/c/x`, `/mnt/c/x`, `/cygdrive/c/x` to `C:\x`. */
+function windowsShellPath(path: string): string {
+	if (!path.startsWith("/") || path.startsWith("//") || path.includes("\\")) return path;
+	const match = path.match(/^\/(?:mnt\/|cygdrive\/)?([a-z])(?:\/(.*))?$/i);
+	if (!match) return path;
+	return `${match[1].toUpperCase()}:\\${match[2]?.replaceAll("/", "\\") ?? ""}`;
+}
+
+export interface ToolPathOptions {
+	home?: string;
+	platform?: NodeJS.Platform;
+}
+
+/**
+ * `raw` as pi's file tools read it before resolving it against a cwd: the
+ * steps above except the last. Callers that must tell a relative path from an
+ * absolute one the way pi will (the worktree rewrite) judge this, not `raw`.
+ */
+export function normalizeToolPath(raw: string, options: ToolPathOptions = {}): string {
+	const platform = options.platform ?? process.platform;
+	const home = options.home ?? homedir();
+	let path = raw.replace(UNICODE_SPACES, " ");
+	if (path.startsWith("@")) path = path.slice(1);
+	if (platform === "win32") path = windowsShellPath(path);
+	if (path === "~") return home;
+	if (path.startsWith("~/") || (platform === "win32" && path.startsWith("~\\"))) return join(home, path.slice(2));
+	if (/^file:\/\//.test(path)) {
+		// A URL this platform cannot map (`file:///x` on Windows has no drive)
+		// stays as written: pi's tool then fails on it, and a guard must not throw.
+		try {
+			return fileURLToPath(path);
+		} catch {
+			return path;
+		}
+	}
+	return path;
+}
+
+/** The absolute path a pi file tool resolves `raw` to from `cwd`. */
+export function resolveToolPath(raw: string, cwd: string, options: ToolPathOptions = {}): string {
+	const path = normalizeToolPath(raw, options);
+	return isAbsolute(path) ? resolve(path) : resolve(cwd, path);
+}

package/extensions/lib/tool-variants.ts

@@ -0,0 +1,69 @@
+/**
+ * Tool descriptions that follow the session, as Claude Code's do.
+ *
+ * Claude Code sends its strongest models short tool descriptions and its
+ * weakest the long ones it wrote for Haiku 4.5; its Bash text also changes
+ * with the permission mode. One Code keys the same split on the model's tier
+ * (`working-docs/decisions/system-prompt.md`, "Four registers"): frontier and
+ * workhorse get the short forms, cheap and tiny the long ones, on every
+ * provider.
+ *
+ * pi copies a tool's description when the tool is registered, so a tool whose
+ * text depends on the session is registered again when that text changes
+ * (`registerVariantTool`). This can also move a tool in pi's active tool
+ * order, so only a model-tier change may re-register after the first request.
+ * The tier changes with the model, which starts a new provider cache anyway.
+ * Permission-mode variants freeze at the first request (bash/index.ts); live
+ * changes ride reminders and the permission gate, never the cached tool list.
+ */
+
+import type { ExtensionAPI, ToolDefinition } from "@earendil-works/pi-coding-agent";
+import type { PromptTier } from "./model-tier.ts";
+import { sessionModelTier } from "./session-model-tier.ts";
+
+/** Which of Claude Code's description forms a tool carries. */
+export type DescriptionForm = "short" | "long";
+
+/** Claude Code's short forms on frontier and workhorse; its long forms on cheap and tiny. */
+export function descriptionForm(tier: PromptTier): DescriptionForm {
+	return tier === "cheap" || tier === "tiny" ? "long" : "short";
+}
+
+// Every tool definition shape registerTool accepts; the concrete generics differ per tool.
+type AnyToolDefinition = ToolDefinition<any, any, any>;
+
+/**
+ * Register `define(initial)` now, and return a setter that registers the tool
+ * again with `define(next)` when `next` differs from the variant in force.
+ * Repeated calls with the same variant do nothing, so callers can apply the
+ * session's facts on every event that might change them.
+ */
+export function registerVariantTool<V>(pi: ExtensionAPI, initial: V, define: (variant: V) => AnyToolDefinition): (variant: V) => void {
+	let current = initial;
+	pi.registerTool(define(initial));
+	return (next: V) => {
+		if (next === current) return;
+		current = next;
+		pi.registerTool(define(next));
+	};
+}
+
+/**
+ * Register `tool` with the description `describe` gives the session model's
+ * form, following it through the session: the one call each tool with a
+ * short and a long form makes.
+ */
+export function registerFormTool(pi: ExtensionAPI, tool: AnyToolDefinition, describe: (form: DescriptionForm) => string): void {
+	followDescriptionForm(pi, registerVariantTool<DescriptionForm>(pi, "short", (form) => ({ ...tool, description: describe(form) })));
+}
+
+/** Apply the frozen session tier's form (and the tier it came from) only at session and model boundaries. */
+export function followDescriptionForm(pi: ExtensionAPI, apply: (form: DescriptionForm, tier: PromptTier) => void): void {
+	const requestTier = sessionModelTier(pi);
+	const follow = () => {
+		const tier = requestTier();
+		apply(descriptionForm(tier), tier);
+	};
+	pi.on("session_start", follow);
+	pi.on("model_select", follow);
+}