pi-auto-save-to-markdown 0.7.4 → 0.8.1

package/README.md

@@ -92,7 +92,7 @@ changes never touch the filename, and manually renamed files are left alone.
 ---
 title: "Fix login redirect loop"
 agent: "pi"
-format_version: "1.3"
+format_version: "1.5"
 session_id: "d0a4f541-976d-4d1b-8e1c-30a1f2b3c4d5"
 session_key: "c2088d77"
 branch_last_entry_id: "019be3a2-1f4d-7c8a-9b01-d23e45f6a7b8"
@@ -118,6 +118,11 @@ User <span style="font-size: 0.5em; color: var(--text-faint);">2026-08-29 13:05:
 
 The login page redirects in a loop after the auth refactor...
 
+> [!quote]- Editor Selection
+> [[src/auth/middleware.ts|middleware.ts]] · **lines**: `14-22`
+>
+> export function middleware(request) { … }
+
 ---
 
 Assistant <span style="font-size: 0.5em; color: var(--text-faint);">2026-08-29 13:05:40 · claude-sonnet-4-5</span>
@@ -148,6 +153,27 @@ previews are wrapped in inline code spans (with a delimiter sized to survive
 backticks inside the content), so raw tool output renders literally instead of
 being parsed as markdown.
 
+Prompt blocks the client or the agent injects into a user message — the
+editor's active selection, attached or referenced notes, loaded skills — are
+re-rendered from their raw XML (which Obsidian cannot render and would show
+as literal angle-bracket text) into generic callouts. No block is parsed
+individually: the title is the tag name in words (`editor_selection` →
+Editor Selection), and the body opens with vault-shaped `path`/`location`
+values as bare Obsidian wikilinks (the aliased filename speaks for itself —
+no `path:` label), followed by the remaining attributes as
+`**name**: value` items, then the content. Every callout is preset-collapsed
+— user-provided blocks (selections, note attachments) as `> [!quote]-`, even
+when they carry only attributes (the client emits note references as
+self-closing tags carrying just a path), agent-side skill traces as a
+`> [!note]- Skill · <name>` marker (the loaded skill's name rides the title,
+so the collapsed marker still says which skill; the location follows in the
+body, the content is dropped) — and consecutive blocks of
+the same tag (nothing but whitespace between them) merge into one callout,
+so a run of note references collapses into a single list. Unknown markup is
+left verbatim, so XML pasted as content is never mangled — and the fallback
+filename slug derives from the typed message with every known block
+stripped.
+
 Each message block opens with a setext level-1 info header (`User`,
 `Assistant`) underlined with `===` — one level above the `##` headings AI
 content typically starts with, and distinguishable from content `#` headings

package/README.zh.md

@@ -66,7 +66,7 @@ PI_SAVE_CONVERSATION_DIR=notes/ai pi
 ---
 title: "修复登录重定向死循环"
 agent: "pi"
-format_version: "1.3"
+format_version: "1.5"
 session_id: "d0a4f541-976d-4d1b-8e1c-30a1f2b3c4d5"
 session_key: "c2088d77"
 branch_last_entry_id: "019be3a2-1f4d-7c8a-9b01-d23e45f6a7b8"
@@ -92,6 +92,11 @@ User <span style="font-size: 0.5em; color: var(--text-faint);">2026-08-29 13:05:
 
 auth 重构之后登录页一直重定向死循环……
 
+> [!quote]- Editor Selection
+> [[src/auth/middleware.ts|middleware.ts]] · **lines**: `14-22`
+>
+> export function middleware(request) { … }
+
 ---
 
 Assistant <span style="font-size: 0.5em; color: var(--text-faint);">2026-08-29 13:05:40 · claude-sonnet-4-5</span>
@@ -120,6 +125,21 @@ Obsidian 对 HTML 块内嵌 Markdown 的渲染不可靠；在非 Obsidian 环境
 压过内容中的反引号序列），工具的原始输出因此按字面渲染，不会被当作
 Markdown 解析。
 
+客户端或 agent 注入到用户消息中的提示块——编辑器当前选区、附加或引用的
+笔记、加载的 skill——会从原始 XML（Obsidian 无法渲染，只会显示成裸露的
+尖括号文本）重新渲染为通用 callout。不做任何逐块解析：标题取标记名的分词
+（`editor_selection` → Editor Selection），正文以形似 vault 相对笔记路径的
+`path`/`location` 值开头——直接渲染为不带标签的 Obsidian wikilink（别名
+文件名自解释，`path:` 标签反而冗余），其余属性以 `**属性**: 值` 跟随，
+最后是引用内容。所有 callout 一律预设折叠——用户提供的块（选区、笔记附件）
+为 `> [!quote]-`（仅有属性的自闭合笔记引用同样折叠），agent 侧痕迹（skill）
+为 `> [!note]- Skill · <名称>` 标记（加载的 skill 名称直接进标题，折叠状态
+也能看到是哪个 skill；location 跟在正文，内容丢弃）；连续的同标签块（中间
+只有空白）合并进同一个 callout，一串笔记引用因此收拢为一份列表（skill 标记
+不合并：各自标注各自的 skill）。未知标记原样保留，用户粘贴的
+XML 内容绝不会被误改；回退文件名 slug 也从剥离全部已知块后的纯键入文本
+推导。
+
 每个消息块以 setext 一级信息头（`User`、`Assistant`，下一行以 `===` 下划）
 开头——高于 AI 内容常见的 `##` 二级标题，解析时也能与内容中的 `#` 一级标题
 区分开。信息头的元数据（本地日期时间，assistant 消息还带模型名）放在一个小号

package/index.ts

@@ -54,6 +54,31 @@
  *   of being parsed as markdown. A result whose call was saved in
  *   an earlier file (mid-turn manual save) falls back to a standalone
  *   one-line block.
+ * - Injected prompt blocks: the host client and the agent runtime append
+ *   machine-readable XML to user messages — the editor's active selection
+ *   (CDATA content), note references and attachments (linked_note /
+ *   linked_content), loaded skills, and their kin. Raw markup is noise
+ *   Obsidian cannot render (unknown tags are not HTML; CDATA is XML), so
+ *   every block in a known vocabulary is re-rendered generically (see
+ *   markdown.ts) — no per-tag formatting: the callout title is the tag name
+ *   in words, the body opens with vault-shaped path/location values as
+ *   bare wikilinks (the aliased filename is self-explanatory — a `path:`
+ *   label is noise) followed by the remaining attributes as
+ *   "**name**: value" lines, then the content (the client's `]]>`
+ *   split-escaping reversed). Every callout is preset-collapsed: visible
+ *   blocks (selections, note references, attachments) as `> [!quote]-`,
+ *   whether they carry content or only attributes (the client emits note
+ *   references as self-closing tags whose whole payload is a path
+ *   attribute), agent-side traces (skills) as a `> [!note]- Skill · <name>`
+ *   marker — the loaded skill's name rides the title so the collapsed
+ *   marker still says which skill, the location follows in the body, the
+ *   content is dropped — and consecutive visible same-tag blocks (nothing
+ *   but whitespace between them) merge into one callout, so a run of note
+ *   references collapses into a single list (skill markers never merge:
+ *   each names its own skill). Title
+ *   derivation strips every known block — the typed message is the title.
+ *   Unknown markup is left verbatim so XML pasted as content is never
+ *   mangled.
  * - Branching: each file records exactly ONE branch (the root→leaf path
  *   returned by sessionManager.getBranch()). State is persisted via
  *   `pi.appendEntry()` custom entries, which are part of the session tree
@@ -160,6 +185,7 @@ import * as fsSync from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
 import { debug } from "./debug.js";
+import { callout, inlineCode, renderUserMessageText, stripInjectedBlocks } from "./markdown.js";
 
 const CUSTOM_TYPE = "pi-claudian-auto-save-markdown";
 const ENV_SUBDIR = "PI_SAVE_CONVERSATION_DIR";
@@ -199,7 +225,7 @@ const SAVE_STATE_SCHEMA = "1.2";
  * the frontmatter and the document heading); additive frontmatter fields do
  * NOT bump it — they are invisible to any within-major parser.
  */
-const FORMAT_VERSION = "1.3";
+const FORMAT_VERSION = "1.5";
 
 /**
  * Package version of this extension, read best-effort from the adjacent
@@ -888,7 +914,12 @@ export default function (pi: ExtensionAPI) {
 
   function firstUserText(messages: SessionMessageEntry[]): string | undefined {
     for (const e of messages) {
-      if (e.message.role === "user") return userText(e.message.content) || undefined;
+      if (e.message.role === "user") {
+        // Title derivation reads the plain typed message — every known
+        // injected block (see markdown.ts) is stripped, mirroring how the
+        // client strips the same blocks for its own session titles.
+        return stripInjectedBlocks(userText(e.message.content)) || undefined;
+      }
     }
     return undefined;
   }
@@ -932,19 +963,6 @@ export default function (pi: ExtensionAPI) {
 
   // ---------- markdown rendering ----------
 
-  /**
-   * Inline code span for arbitrary raw output (tool results, argument JSON):
-   * the delimiter is always one backtick longer than the longest backtick run
-   * inside the text, so content that itself contains backticks cannot break
-   * the span. Tool output renders literally instead of being parsed as
-   * markdown (headings, bold, wiki links …).
-   */
-  function inlineCode(text: string): string {
-    const longest = (text.match(/`+/g) ?? []).reduce((a, r) => Math.max(a, r.length), 0);
-    const fence = "`".repeat(longest + 1);
-    return `${fence}${text}${fence}`;
-  }
-
   /**
    * Strip leading blank lines and trailing whitespace from a rendered block,
    * so joins and separators always keep exactly one blank line around them
@@ -987,17 +1005,6 @@ export default function (pi: ExtensionAPI) {
     return [...counts].map(([n, c]) => (c > 1 ? `${n} ×${c}` : n)).join(", ");
   }
 
-  /**
-   * Collapsed Obsidian callout (`> [!type]- title`) wrapping a markdown body:
-   * every body line is prefixed with `>` (empty lines become bare `>`), so the
-   * body keeps rendering as markdown while folding works in both Obsidian
-   * views. Outside Obsidian the callout degrades to a plain blockquote.
-   */
-  function callout(type: string, title: string, body: string): string {
-    const lines = body.split("\n").map((line) => (line ? `> ${line}` : ">"));
-    return `> [!${type}]- ${title}\n${lines.join("\n")}`;
-  }
-
   /**
    * Fold tool calls and their paired results into one collapsed callout.
    * Argument JSON and result previews are wrapped in inline code spans, so
@@ -1074,7 +1081,7 @@ export default function (pi: ExtensionAPI) {
       const m = e.message;
       const t = dateTime(e.timestamp);
       if (m.role === "user") {
-        blocks.push(`${messageHeader("User", t)}\n\n${userText(m.content)}`);
+        blocks.push(`${messageHeader("User", t)}\n\n${renderUserMessageText(userText(m.content))}`);
       } else if (m.role === "assistant") {
         blocks.push(renderAssistant(m, t, results));
       } else if (m.role === "toolResult") {

package/markdown.ts

@@ -0,0 +1,269 @@
+/**
+ * Shared markdown rendering helpers for the saved conversation format, plus
+ * the transformer for prompt blocks the host injects into user messages.
+ *
+ * The code-span and callout helpers are the document format's building
+ * blocks (see index.ts's header comment for how the saved file is
+ * assembled). The injected-block transformer below re-renders the
+ * machine-readable XML the Claudian client and the agent runtime append to
+ * user message text: raw, that markup is noise notes apps cannot render —
+ * unknown tags are not HTML and CDATA is XML — so every block in a known
+ * vocabulary becomes a readable callout, and anything unknown stays verbatim
+ * so XML a user pasted as content is never mangled.
+ */
+
+// ---------- code spans & callouts ----------
+
+/**
+ * Inline code span for arbitrary raw output (tool results, argument JSON):
+ * the delimiter is always one backtick longer than the longest backtick run
+ * inside the text, so content that itself contains backticks cannot break
+ * the span. Tool output renders literally instead of being parsed as
+ * markdown (headings, bold, wiki links …).
+ */
+export function inlineCode(text: string): string {
+  const longest = (text.match(/`+/g) ?? []).reduce((a, r) => Math.max(a, r.length), 0);
+  const fence = "`".repeat(longest + 1);
+  return `${fence}${text}${fence}`;
+}
+
+/**
+ * Obsidian callout (`> [!type]- title`) wrapping a markdown body: every body
+ * line is prefixed with `>` (empty lines become bare `>`), so the body keeps
+ * rendering as markdown while folding works in both Obsidian views. Outside
+ * Obsidian the callout degrades to a plain blockquote. An empty body renders
+ * the title alone.
+ */
+export function callout(type: string, title: string, body: string, fold = true): string {
+  const header = `> [!${type}]${fold ? "-" : ""} ${title}`;
+  if (!body) return header;
+  const lines = body.split("\n").map((line) => (line ? `> ${line}` : ">"));
+  return `${header}\n${lines.join("\n")}`;
+}
+
+// ---------- client-injected prompt blocks ----------
+
+/**
+ * Injected-block vocabulary, harvested from the Claudian bundle's own
+ * block-stripping regexes and from observed sessions. Membership decides
+ * visibility only — rendering itself is fully generic (no per-tag format
+ * logic):
+ *
+ * - Visible: user-provided material. Selections of every surface
+ *   (editor/canvas/browser), the current note, attached files, and note
+ *   references (linked_note / linked_content — the client's attachment
+ *   mechanism; a typed @-mention stays as plain text in the message, these
+ *   are the machine copy).
+ * - Hidden: agent-side traces (loaded skills) — rendered as a folded
+ *   `> [!note]- Skill · <name>` marker with the name riding the title
+ *   (which skill was loaded is the marker's whole meaning and must survive
+ *   the collapsed view), the content dropped (a skill is re-loadable from
+ *   its location).
+ *
+ * Unknown tags are left verbatim: this is both the safety boundary against
+ * mangling pasted XML and a soft failure mode for future client tags (they
+ * stay raw until the vocabulary is extended).
+ */
+const VISIBLE_TAGS = [
+  "editor_selection",
+  "editor_cursor",
+  "current_note",
+  "context_files",
+  "canvas_selection",
+  "browser_selection",
+  "linked_note",
+  "linked_content",
+] as const;
+const HIDDEN_TAGS = new Set<string>(["skill"]);
+const ALL_TAGS = [...VISIBLE_TAGS, ...HIDDEN_TAGS];
+
+/**
+ * One injected block, in the grammar the client itself uses: a self-closing
+ * `<tag attrs/>` or a paired `<tag attrs>content</tag>` (content may be a
+ * CDATA section). Attribute values never contain raw `<`, `>` or `"` — the
+ * client XML-escapes them — which is what the attribute group relies on.
+ */
+const INJECTED_BLOCK_RE = new RegExp(
+  `<(${ALL_TAGS.join("|")})\\b((?:\\s[^<>]*?)?)(?:/>|>([\\s\\S]*?)</\\1\\s*>)`,
+  "g",
+);
+
+/** "editor_selection" → "Editor Selection" — the display title of a tag. */
+function tagTitle(tag: string): string {
+  return tag
+    .split("_")
+    .map((w) => (w ? w[0].toUpperCase() + w.slice(1) : w))
+    .join(" ");
+}
+
+/** Decode the XML entities the client escapes attribute values with. */
+function decodeEntities(s: string): string {
+  return s
+    .replace(/&#(\d+);/g, (m, d: string) => {
+      try {
+        return String.fromCodePoint(Number(d));
+      } catch {
+        return m;
+      }
+    })
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .replace(/&quot;/g, '"')
+    .replace(/&apos;/g, "'")
+    .replace(/&amp;/g, "&"); // last: "&amp;lt;" must not double-decode
+}
+
+/** Attribute pairs of an injected block, in source order. */
+function parseAttrs(attrs: string): { name: string; value: string }[] {
+  const out: { name: string; value: string }[] = [];
+  for (const m of attrs.matchAll(/([a-zA-Z_][a-zA-Z0-9_.-]*)\s*=\s*(?:"([^"]*)"|'([^']*)')/g)) {
+    out.push({ name: m[1], value: decodeEntities(m[2] ?? m[3] ?? "") });
+  }
+  return out;
+}
+
+/**
+ * Unwrap the client's CDATA wrapper and reverse its `]]>` split-escaping
+ * (the client rewrites a literal `]]>` inside a selection as
+ * `]]]]><![CDATA[>`). Content without a CDATA wrapper passes through
+ * unchanged (linked_note names, raw bodies).
+ */
+function unwrapCDATA(content: string): string {
+  const m = /^\s*<!\[CDATA\[([\s\S]*)\]\]>\s*$/.exec(content);
+  return m ? m[1].replace(/\]\]\]\]><!\[CDATA\[>/g, "]]>") : content;
+}
+
+/**
+ * Whether a value is a vault-relative note path: no leading slash or home
+ * marker, no drive colon or wikilink-hostile characters, and shaped like a
+ * note (a folder or a .md extension). Values that fail — absolute
+ * filesystem paths, plain names, anything else — stay in code spans.
+ */
+function isVaultNotePath(value: string): boolean {
+  return (
+    value.length > 0 &&
+    !/^[~/]/.test(value) &&
+    !/[:\r\n[\]|#^<>]/.test(value) &&
+    (/\.md$/i.test(value) || value.includes("/"))
+  );
+}
+
+/** Vault path as a wikilink, aliased to its basename when it has folders. */
+function wikilinkOf(path: string): string {
+  const base = path.slice(path.lastIndexOf("/") + 1);
+  return base && base !== path ? `[[${path}|${base}]]` : `[[${path}]]`;
+}
+
+/** Whether an attribute renders as a bare wikilink (a vault-shaped path/location). */
+function isWikilinkAttr(p: { name: string; value: string }): boolean {
+  return (p.name === "path" || p.name === "location") && isVaultNotePath(p.value);
+}
+
+/**
+ * Attribute pairs of one injected block as body items: a `path`/`location`
+ * value shaped like a vault-relative note path becomes a BARE wikilink —
+ * no `**name**:` prefix, because the aliased filename is self-explanatory
+ * (the file is user-provided material) and the label only adds noise — and
+ * sorts first, so the reference leads the line; every other attribute stays
+ * a labeled `**name**: value` item in source order.
+ */
+function attrItems(attrs: string): string[] {
+  const pairs = parseAttrs(attrs);
+  return [
+    ...pairs.filter(isWikilinkAttr).map((p) => wikilinkOf(p.value)),
+    ...pairs.filter((p) => !isWikilinkAttr(p)).map((p) => `**${p.name}**: ${inlineCode(p.value)}`),
+  ];
+}
+
+/**
+ * Hidden block as its own self-contained marker callout: the `name`
+ * attribute joins the title — WHICH skill was loaded is the marker's whole
+ * meaning, and a collapsed `Skill` alone would say nothing — while the
+ * remaining attributes (the location) form the body and the content is
+ * dropped (a skill is re-loadable from its location). A hidden block with
+ * no attributes at all carries no information and is removed.
+ */
+function hiddenCallout(tag: string, attrs: string): string {
+  const pairs = parseAttrs(attrs);
+  if (pairs.length === 0) return "";
+  const name = pairs.find((p) => p.name === "name")?.value;
+  const body = pairs
+    .filter((p) => p.name !== "name")
+    .map((p) => (isWikilinkAttr(p) ? wikilinkOf(p.value) : `**${p.name}**: ${inlineCode(p.value)}`))
+    .join(" · ");
+  return callout("note", name ? `${tagTitle(tag)} · ${name}` : tagTitle(tag), body);
+}
+
+/**
+ * One VISIBLE injected block's rendered body (no callout wrapper; hidden
+ * blocks render through hiddenCallout): the attribute items, then (after a
+ * blank line) the content.
+ *
+ * linked_note is the one content concession: its whole payload IS a note
+ * reference, so content shaped like a vault note path renders as a wikilink
+ * too — the same mechanical shape test, no semantics.
+ */
+function injectedBlockBody(tag: string, attrs: string, content: string): string {
+  const attrLine = attrItems(attrs).join(" · ");
+  const text = content ? unwrapCDATA(content).trim() : "";
+  const body = tag === "linked_note" && isVaultNotePath(text) ? wikilinkOf(text) : text;
+  return attrLine ? (body ? `${attrLine}\n\n${body}` : attrLine) : body;
+}
+
+/**
+ * User message text for the saved body: every known injected block renders
+ * as a preset-collapsed callout — visible blocks as `> [!quote]-`, hidden
+ * blocks as a `> [!note]-` marker — and a RUN of visible same-tag blocks
+ * with nothing but whitespace between them merges into ONE callout (a user
+ * attaching five notes saves one Linked Content callout listing five
+ * wikilinks, not five callouts; hidden markers never merge — each names its
+ * own skill). Anything else stays verbatim.
+ */
+export function renderUserMessageText(text: string): string {
+  const re = new RegExp(INJECTED_BLOCK_RE, "g");
+  let out = "";
+  let pos = 0;
+  let runTag: string | null = null;
+  const runBodies: string[] = [];
+  const flushRun = () => {
+    if (runTag === null) return;
+    out += callout("quote", tagTitle(runTag), runBodies.join("\n\n"));
+    runTag = null;
+    runBodies.length = 0;
+  };
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    const tag = m[1];
+    const gap = text.slice(pos, m.index);
+    const mergeable = runTag !== null && tag === runTag && gap.trim() === "";
+    if (!mergeable) {
+      // A different tag, real text between the blocks, or a hidden block
+      // (self-contained markers never merge) ends the run; the gap is
+      // emitted only then — inside a run it is whitespace.
+      flushRun();
+      out += gap;
+    }
+    if (HIDDEN_TAGS.has(tag)) {
+      out += hiddenCallout(tag, m[2]);
+    } else {
+      if (runTag === null) runTag = tag;
+      runBodies.push(injectedBlockBody(tag, m[2], m[3] ?? ""));
+    }
+    pos = re.lastIndex;
+  }
+  flushRun();
+  return out + text.slice(pos);
+}
+
+/**
+ * The plain typed message: every known injected block removed and the
+ * blank lines they leave behind collapsed — this is what title derivation
+ * (frontmatter title, document heading, fallback filename slug) reads,
+ * mirroring how the client strips the same blocks for its own titles.
+ */
+export function stripInjectedBlocks(text: string): string {
+  return text
+    .replace(INJECTED_BLOCK_RE, "")
+    .replace(/\n{3,}/g, "\n\n")
+    .trim();
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-auto-save-to-markdown",
-  "version": "0.7.4",
+  "version": "0.8.1",
   "description": "Pi extension that automatically saves each completed conversation turn as a markdown file with YAML frontmatter, one file per session-tree branch.",
   "type": "module",
   "license": "MIT",
@@ -41,6 +41,7 @@
   "files": [
     "index.ts",
     "debug.ts",
+    "markdown.ts",
     "README.md",
     "README.zh.md"
   ],