pi-advisor-flow 0.5.6 → 0.6.0

package/src/model-stream.ts

@@ -6,7 +6,7 @@ import {
   stream,
 } from "@earendil-works/pi-ai/compat";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { splitRef } from "./config/state.js";
+import { splitRef } from "./config/state.ts";
 
 export interface ResolvedConfiguredModel {
   apiKey: string;
@@ -61,7 +61,7 @@ export interface CollectedTextStream {
 
 export const ADVISOR_STREAM_UPDATE_INTERVAL_MS = 90;
 
-export interface CoalescedUpdateResult {
+interface CoalescedUpdateResult {
   error?: unknown;
   failed: boolean;
 }
@@ -81,12 +81,7 @@ export interface CoalescedUpdateScheduler {
   ) => ReturnType<typeof setTimeout>;
 }
 
-/**
- * Keep stream updates responsive without forwarding every provider delta to
- * the UI. The first update in a burst is immediate; later updates are kept as
- * the latest value and published at most once per interval. `flush()` closes
- * the publisher and is intended for terminal success/error paths.
- */
+/** Publishes at most one stream update per interval; the first in a burst is immediate and flush() closes for terminal paths. */
 export const createCoalescedUpdate = <T>(
   publish: (value: T) => void,
   intervalMs = ADVISOR_STREAM_UPDATE_INTERVAL_MS,
@@ -141,6 +136,8 @@ export const createCoalescedUpdate = <T>(
         : scheduler.now() - lastPublishedAt;
     const delay = Math.max(0, intervalMs - elapsed);
     if (delay === 0) {
+      // A zero delay publishes synchronously rather than through the timer,
+      // so the first update of a burst lands before the caller continues.
       publishPending();
       return;
     }

package/src/outcomes.ts

@@ -15,10 +15,7 @@ import { getAgentDir } from "@earendil-works/pi-coding-agent";
 
 export type OutcomeAdoption = "followed" | "not-followed" | "unknown";
 export type OutcomeValidation = "passed" | "failed" | "not-run" | "unknown";
-export type OutcomeTrigger =
-  | "manual"
-  | "executor-requested"
-  | "repeated-tool-call";
+type OutcomeTrigger = "manual" | "executor-requested" | "repeated-tool-call";
 export const ADOPTIONS: OutcomeAdoption[] = [
   "followed",
   "not-followed",
@@ -115,7 +112,7 @@ const withOutcomeLock = async <T>(run: () => Promise<T>): Promise<T> => {
   throw new Error("Timed out waiting to append an Advisor outcome.");
 };
 
-export const adviceDigest = (advice: string, key: Buffer) =>
+const adviceDigest = (advice: string, key: Buffer) =>
   createHmac("sha256", key).update(advice).digest("hex").slice(0, 16);
 
 /** Best-effort, global-only, minimal persistent telemetry. */

package/src/pi-settings.ts

@@ -0,0 +1,59 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { getAgentDir } from "@earendil-works/pi-coding-agent";
+
+interface PiGlobalSettings {
+  hideThinkingBlock?: boolean;
+}
+
+interface CachedSetting {
+  hidden: boolean;
+  identity: string;
+  readAt: number;
+}
+
+// Cached per file and re-read on identity change; stat calls are rate-limited because renderers run per frame.
+const SETTING_RECHECK_INTERVAL_MS = 2000;
+const cache = new Map<string, CachedSetting>();
+
+const settingsIdentity = (path: string): string => {
+  try {
+    const stats = statSync(path, { bigint: true });
+    return `${stats.mtimeNs}:${stats.ctimeNs}:${stats.size}:${stats.ino}`;
+  } catch {
+    return `unstattable:${process.hrtime.bigint()}`;
+  }
+};
+
+const readHideThinking = (path: string): boolean => {
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf8"));
+    return (
+      typeof parsed === "object" &&
+      parsed !== null &&
+      (parsed as PiGlobalSettings).hideThinkingBlock === true
+    );
+  } catch {
+    return false;
+  }
+};
+
+/** Whether Pi's `hide_thinking` setting hides rendered thinking blocks. */
+export const piHideThinkingEnabled = (): boolean => {
+  const path = join(getAgentDir(), "settings.json");
+  if (!existsSync(path)) {
+    return false;
+  }
+  const now = Date.now();
+  const cached = cache.get(path);
+  if (cached && now - cached.readAt < SETTING_RECHECK_INTERVAL_MS) {
+    return cached.hidden;
+  }
+  const identity = settingsIdentity(path);
+  const hidden =
+    cached && cached.identity === identity
+      ? cached.hidden
+      : readHideThinking(path);
+  cache.set(path, { hidden, identity, readAt: now });
+  return hidden;
+};

package/src/preferences.ts

@@ -1,9 +1,9 @@
 import { lstat, open, realpath } from "node:fs/promises";
 import { join, relative } from "node:path";
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
-import { redactAndCapText } from "./conversation.js";
+import { redactAndCapText } from "./redaction.ts";
 
-export const PREFERENCES_MAX_BYTES = 8 * 1024;
+const PREFERENCES_MAX_BYTES = 8 * 1024;
 // Keep the local filename components separate from Socket's URL-string heuristic.
 const PREFERENCES_FILENAME = ["advisor-preferences", "md"].join(".");
 export interface TextAttachment {

package/src/redaction.ts

@@ -0,0 +1,50 @@
+import { capUtf8Bytes } from "./content-utils.ts";
+
+const REDACTION_MARKER = "[REDACTED SECRET]";
+const PEM_BEGIN_PATTERN = /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----/gi;
+const PEM_END_PATTERN = /-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/i;
+const SECRET_PATTERNS = [
+  /-----BEGIN(?: [A-Z0-9]+)? PRIVATE KEY-----[\s\S]*?-----END(?: [A-Z0-9]+)? PRIVATE KEY-----/gi,
+  /\bBearer\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+  /\b(?:api[_-]?key|token|secret|password|passwd)\s*[:=]\s*(?:"[^"]*"|'[^']*'|[^\s"'&,;)}\]]+)/gi,
+  /([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi,
+  /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g,
+  /\b(?:aws_secret_access_key|aws_session_token)\s*[:=]\s*[^\s"'&,;)}\]]+/gi,
+] as const;
+
+const redactUnterminatedPem = (value: string): string => {
+  const begins = [...value.matchAll(PEM_BEGIN_PATTERN)];
+  const lastBegin = begins.at(-1);
+  if (lastBegin?.index === undefined) {
+    return value;
+  }
+  const hasEnd = PEM_END_PATTERN.test(
+    value.slice(lastBegin.index + lastBegin[0].length)
+  );
+  return hasEnd
+    ? value
+    : `${value.slice(0, lastBegin.index)}${REDACTION_MARKER}`;
+};
+
+/** Redacts common credential forms locally; it is not a data-classification system. */
+export const redactSecrets = (value: string): string => {
+  let redacted = redactUnterminatedPem(value);
+  for (const pattern of SECRET_PATTERNS) {
+    redacted = redacted.replace(pattern, (_match, scheme) =>
+      typeof scheme === "string"
+        ? `${scheme}${REDACTION_MARKER}@`
+        : REDACTION_MARKER
+    );
+  }
+  return redacted;
+};
+
+/** Redacts before a byte-safe cap so no secret fragment survives truncation. */
+export const redactAndCapText = (
+  value: string,
+  maxBytes: number,
+  redact = true
+): string => {
+  const source = redact ? redactSecrets(value) : value;
+  return capUtf8Bytes(source, maxBytes);
+};