pi-code 1.0.5 → 1.0.7

package/extensions/internal/instruction-events.ts

@@ -15,7 +15,7 @@ export const INSTRUCTIONS_CHANNEL = 'pi-code:instructions'
 /** Claude's memory_type vocabulary for InstructionsLoaded payloads. */
 export type InstructionMemoryType = 'User' | 'Project' | 'Local' | 'Managed'
 
-const MEMORY_TYPES: readonly string[] = ['User', 'Project', 'Local', 'Managed']
+const MEMORY_TYPES: ReadonlySet<string> = new Set(['User', 'Project', 'Local', 'Managed'])
 
 export interface InstructionLoadEvent {
   /** Absolute path of the instruction file that entered context. */
@@ -35,7 +35,7 @@ export function isInstructionLoadEvent(data: unknown): data is InstructionLoadEv
   const event = data as InstructionLoadEvent | null
   if (event === null || typeof event !== 'object') return false
   if (typeof event.file_path !== 'string' || typeof event.load_reason !== 'string') return false
-  if (!MEMORY_TYPES.includes(event.memory_type)) return false
+  if (!MEMORY_TYPES.has(event.memory_type)) return false
   if (event.globs !== undefined && !(Array.isArray(event.globs) && event.globs.every((glob) => typeof glob === 'string'))) return false
   if (event.trigger_file_path !== undefined && typeof event.trigger_file_path !== 'string') return false
   if (event.parent_file_path !== undefined && typeof event.parent_file_path !== 'string') return false

package/extensions/internal/managed-settings.ts

@@ -15,7 +15,7 @@ import * as fs from 'node:fs'
 export function managedSettingsPath(platform: NodeJS.Platform = process.platform): string {
   if (platform === 'darwin') return '/Library/Application Support/ClaudeCode/managed-settings.json'
   // The legacy C:\ProgramData\ClaudeCode path was dropped in Claude Code v2.1.75.
-  if (platform === 'win32') return 'C:\\Program Files\\ClaudeCode\\managed-settings.json'
+  if (platform === 'win32') return String.raw`C:\Program Files\ClaudeCode\managed-settings.json`
   return '/etc/claude-code/managed-settings.json'
 }
 

package/extensions/internal/mcp-oauth.ts

@@ -32,19 +32,28 @@ interface StoredAuth {
  * the store directory and distinct names from colliding after sanitization. */
 function storeFileFor(serverName: string): string {
   const digest = crypto.createHash('sha256').update(serverName).digest('hex').slice(0, 8)
-  const safe =
-    serverName
-      .replace(/[^A-Za-z0-9_-]+/g, '-')
-      .replace(/^-+|-+$/g, '')
-      .slice(0, 40) || 'server'
+  // Collapse disallowed runs to a single hyphen, then strip leading and trailing
+  // hyphens by index. The old /^-+|-+$/g trim rescanned on every hyphen of a long run
+  // (its trailing-anchored branch backtracks per start position), which is quadratic.
+  const collapsed = serverName.replace(/[^A-Za-z0-9_-]+/g, '-')
+  let start = 0
+  let end = collapsed.length
+  while (start < end && collapsed[start] === '-') start++
+  while (end > start && collapsed[end - 1] === '-') end--
+  const safe = collapsed.slice(start, end).slice(0, 40) || 'server'
   return path.join(getAgentDir(), 'mcp-oauth', `${safe}-${digest}.json`)
 }
 
 export class FileOAuthProvider implements OAuthClientProvider {
   private readonly storePath: string
-  private data: StoredAuth
+  private readonly data: StoredAuth
   private port = 0
   private readonly onRedirect: (authorizationUrl: URL) => void
+  // A fresh random CSRF token per login attempt. The SDK puts it in the authorization
+  // URL's `state` param, the server echoes it back on the redirect, and waitForAuthCode
+  // rejects any callback that does not carry it, so another local process or an open web
+  // page cannot inject an authorization code into this login (RFC 8252 8.9).
+  private readonly loginState = crypto.randomBytes(16).toString('hex')
 
   constructor(serverName: string, onRedirect: (authorizationUrl: URL) => void) {
     this.storePath = storeFileFor(serverName)
@@ -113,6 +122,12 @@ export class FileOAuthProvider implements OAuthClientProvider {
     return this.data.tokens !== undefined
   }
 
+  /** The CSRF token the SDK adds to the authorization URL as `state`; waitForAuthCode
+   * verifies the redirect echoes exactly this value. */
+  state(): string {
+    return this.loginState
+  }
+
   redirectToAuthorization(authorizationUrl: URL): void {
     this.onRedirect(authorizationUrl)
   }
@@ -143,11 +158,30 @@ export async function startCallbackServer(preferredPort?: number): Promise<{ ser
   return { server, port: (server.address() as { port: number }).port }
 }
 
-export function waitForAuthCode(server: http.Server, timeoutMs: number): Promise<string> {
+export function waitForAuthCode(server: http.Server, timeoutMs: number, expectedState?: string): Promise<string> {
   return new Promise((resolve, reject) => {
     const timer = setTimeout(() => reject(new Error(`authorization timed out after ${timeoutMs}ms`)), timeoutMs)
+    // Do not let the pending timer keep the process alive on its own: if the login is
+    // abandoned or resolved out of band, the event loop can still drain.
+    timer.unref?.()
     server.on('request', (request, response) => {
       const url = new URL(request.url ?? '/', 'http://127.0.0.1')
+      // Only the redirect path settles the login. A stray request (a favicon fetch, a
+      // local port scan, or a forged redirect from another process or an open web page)
+      // is answered but ignored, so it can neither inject a code nor abort the login by
+      // rejecting the promise (a repeatable DoS on a stable, guessable loopback port).
+      if (url.pathname !== '/callback') {
+        response.writeHead(404, { 'content-type': 'text/plain' })
+        response.end('not found')
+        return
+      }
+      // The CSRF check: a callback that does not echo this login's state is rejected
+      // without settling, so an attacker who cannot read the state cannot complete it.
+      if (expectedState !== undefined && url.searchParams.get('state') !== expectedState) {
+        response.writeHead(400, { 'content-type': 'text/plain' })
+        response.end('state mismatch')
+        return
+      }
       const code = url.searchParams.get('code')
       const error = url.searchParams.get('error')
       response.writeHead(200, { 'content-type': 'text/html' })
@@ -161,7 +195,9 @@ export function waitForAuthCode(server: http.Server, timeoutMs: number): Promise
 
 /** Best-effort browser launch; the caller also surfaces the URL as text. */
 export function openBrowser(url: string): void {
-  const command = process.platform === 'darwin' ? 'open' : process.platform === 'win32' ? 'cmd' : 'xdg-open'
+  let command = 'xdg-open'
+  if (process.platform === 'darwin') command = 'open'
+  else if (process.platform === 'win32') command = 'cmd'
   const args = process.platform === 'win32' ? ['/c', 'start', '', url] : [url]
   try {
     spawn(command, args, { stdio: 'ignore', detached: true }).unref()

package/extensions/internal/path-rules.ts

@@ -21,8 +21,66 @@ export interface PathAnchors {
 
 const escapeRegExp = (text: string): string => text.replace(/[.*+?^${}()|[\]\\]/g, String.raw`\$&`)
 
-/** One gitignore-style pattern as an anchored regular expression source. */
-export function globToRegExpSource(pattern: string): string {
+/** Cap on brace-expanded alternatives per pattern, mirroring Claude's ~1000
+ * budget; an over-budget pattern is used unexpanded. */
+const BRACE_EXPANSION_LIMIT = 1000
+
+interface BraceGroup {
+  start: number
+  end: number
+  options: string[]
+}
+
+/** The `{...}` group opening at `open`, or null when it is unmatched or carries no
+ * top-level comma (literal braces). Options are split on commas at the group's own
+ * depth so a nested group stays inside one option. */
+function parseBraceGroup(pattern: string, open: number): BraceGroup | null {
+  let depth = 1
+  let optionStart = open + 1
+  const options: string[] = []
+  for (let i = open + 1; i < pattern.length; i += 1) {
+    const ch = pattern[i]
+    if (ch === '{') depth += 1
+    else if (ch === ',' && depth === 1) {
+      options.push(pattern.slice(optionStart, i))
+      optionStart = i + 1
+    } else if (ch === '}' && --depth === 0) {
+      if (options.length === 0) return null // no top-level comma: literal braces
+      options.push(pattern.slice(optionStart, i))
+      return { start: open, end: i, options }
+    }
+  }
+  return null
+}
+
+/** The first expandable `{...}` group. A comma-less or unmatched `{` is skipped as
+ * literal, so the scan can still find an expandable group nested inside it. */
+function findBraceGroup(pattern: string): BraceGroup | null {
+  for (let open = pattern.indexOf('{'); open !== -1; open = pattern.indexOf('{', open + 1)) {
+    const group = parseBraceGroup(pattern, open)
+    if (group) return group
+  }
+  return null
+}
+
+/** Bash-style brace expansion of one pattern into its alternatives: each group
+ * multiplies out (Cartesian across groups, nested groups recurse). Returns null
+ * when the expansion would exceed the budget. */
+function expandBraces(pattern: string): string[] | null {
+  const group = findBraceGroup(pattern)
+  if (group === null) return [pattern]
+  const expanded: string[] = []
+  for (const option of group.options) {
+    const branch = expandBraces(pattern.slice(0, group.start) + option + pattern.slice(group.end + 1))
+    if (branch === null) return null
+    expanded.push(...branch)
+    if (expanded.length > BRACE_EXPANSION_LIMIT) return null
+  }
+  return expanded
+}
+
+/** One glob pattern, braces already expanded, as a regular expression source. */
+function translateGlob(pattern: string): string {
   let out = ''
   let i = 0
   while (i < pattern.length) {
@@ -54,6 +112,15 @@ export function globToRegExpSource(pattern: string): string {
   return out
 }
 
+/** One gitignore-style pattern as an anchored regular expression source. Brace
+ * groups (`{ts,tsx}`, nested, Cartesian across groups) expand into ORed
+ * alternatives; an over-budget expansion falls back to the literal pattern. */
+export function globToRegExpSource(pattern: string): string {
+  const alternatives = expandBraces(pattern) ?? [pattern]
+  if (alternatives.length === 1) return translateGlob(alternatives[0])
+  return `(?:${alternatives.map(translateGlob).join('|')})`
+}
+
 /** A rule resolved to an absolute glob per its anchor form. */
 function resolveRule(rule: string, anchors: PathAnchors): string {
   if (rule.startsWith('//')) return rule.slice(1)

package/extensions/internal/plugins.ts

@@ -64,6 +64,15 @@ function enabledMap(settingsFiles: string[]): Record<string, boolean> {
   return merged
 }
 
+/** Copy one plugin config's `options` into `target`, coercing scalars to strings and
+ * ignoring the rest, later keys winning. */
+function mergeOptionValues(target: Record<string, string>, options: object): void {
+  for (const [key, value] of Object.entries(options)) {
+    if (typeof value === 'string') target[key] = value
+    else if (typeof value === 'number' || typeof value === 'boolean') target[key] = String(value)
+  }
+}
+
 /** `pluginConfigs[id].options` per plugin id, later files winning per key. */
 function pluginConfigsMap(settingsFiles: string[]): Record<string, Record<string, string>> {
   const merged: Record<string, Record<string, string>> = {}
@@ -74,10 +83,7 @@ function pluginConfigsMap(settingsFiles: string[]): Record<string, Record<string
       const options = (config as Record<string, unknown>)?.options
       if (options === null || typeof options !== 'object') continue
       const values = merged[id] ?? {}
-      for (const [key, value] of Object.entries(options)) {
-        if (typeof value === 'string') values[key] = value
-        else if (typeof value === 'number' || typeof value === 'boolean') values[key] = String(value)
-      }
+      mergeOptionValues(values, options)
       merged[id] = values
     }
   }
@@ -99,27 +105,34 @@ export function installedPlugins(home: string, extraSettingsFiles: string[] = []
   const plugins: InstalledPlugin[] = []
   for (const marketplace of listDirs(cacheDir)) {
     for (const pluginDir of listDirs(path.join(cacheDir, marketplace))) {
-      const qualified = `${pluginDir}@${marketplace}`
-      const state = enabled[qualified] ?? enabled[pluginDir]
-      if (state !== true) continue
-      const version = newestVersion(listDirs(path.join(cacheDir, marketplace, pluginDir)))
-      if (!version) continue
-      const root = path.join(cacheDir, marketplace, pluginDir, version)
-      const manifest = readJson(path.join(root, '.claude-plugin', 'plugin.json'))
-      const name = typeof manifest.name === 'string' && manifest.name.length > 0 ? manifest.name : pluginDir
-      const id = qualified.replace(/[^A-Za-z0-9]+/g, '-')
-      const userConfig = configs[qualified] ?? configs[pluginDir] ?? configs[name]
-      plugins.push({ name, root, dataDir: path.join(home, '.claude', 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) })
+      const plugin = resolvePlugin(home, cacheDir, marketplace, pluginDir, enabled, configs)
+      if (plugin) plugins.push(plugin)
     }
   }
   return plugins
 }
 
+/** Resolve one cached plugin directory into an enabled InstalledPlugin, or null to skip
+ * it: not turned on in settings, or no version directory on disk yet. */
+function resolvePlugin(home: string, cacheDir: string, marketplace: string, pluginDir: string, enabled: Record<string, boolean>, configs: Record<string, Record<string, string>>): InstalledPlugin | null {
+  const qualified = `${pluginDir}@${marketplace}`
+  const state = enabled[qualified] ?? enabled[pluginDir]
+  if (state !== true) return null
+  const version = newestVersion(listDirs(path.join(cacheDir, marketplace, pluginDir)))
+  if (!version) return null
+  const root = path.join(cacheDir, marketplace, pluginDir, version)
+  const manifest = readJson(path.join(root, '.claude-plugin', 'plugin.json'))
+  const name = typeof manifest.name === 'string' && manifest.name.length > 0 ? manifest.name : pluginDir
+  const id = qualified.replace(/[^A-Za-z0-9]+/g, '-')
+  const userConfig = configs[qualified] ?? configs[pluginDir] ?? configs[name]
+  return { name, root, dataDir: path.join(home, '.claude', 'plugins', 'data', id), manifest, ...(userConfig ? { userConfig } : {}) }
+}
+
 /** The two plugin path variables, textually substituted into plugin-shipped
  * config (hook commands, MCP server definitions, command bodies). */
 export function substitutePluginVars(value: string, plugin: InstalledPlugin): string {
   return value
     .replaceAll('${CLAUDE_PLUGIN_ROOT}', plugin.root)
     .replaceAll('${CLAUDE_PLUGIN_DATA}', plugin.dataDir)
-    .replace(/\$\{user_config\.([A-Za-z0-9_]+)\}/g, (_, key: string) => plugin.userConfig?.[key] ?? '')
+    .replace(/\$\{user_config\.(\w+)\}/g, (_, key: string) => plugin.userConfig?.[key] ?? '')
 }

package/extensions/internal/strip-comments.ts

@@ -25,51 +25,74 @@ function fenceLength(lineStart: string, marker: string): number {
   return length
 }
 
+// CommonMark closes a fenced block only with a fence of the same character that
+// is at least as long as the opener, so both are tracked: a shorter same-char
+// fence line (the classic 3-backtick block quoted inside a 4-backtick one) is
+// content, not a closer.
+interface Fence {
+  marker: string
+  length: number
+}
+
+/** The fence state after a line, plus whether the line is fenced code (opener,
+ * body, or closer) and so emitted verbatim rather than scanned for comments. */
+function stepFence(fence: Fence | null, trimmed: string, marker: string | null): { fence: Fence | null; fenced: boolean } {
+  if (marker !== null && fence === null) {
+    return { fence: { marker, length: fenceLength(trimmed, marker) }, fenced: true }
+  }
+  if (fence !== null) {
+    const closes = marker === fence.marker && fenceLength(trimmed, marker) >= fence.length
+    return { fence: closes ? null : fence, fenced: true } // closer included: comments are content, not maintainer notes
+  }
+  return { fence, fenced: false }
+}
+
+/** Advance a line while inside an open multi-line comment. Emits any content that
+ * trails the closer onto its own line; returns whether the comment stays open. */
+function continueOpenComment(out: string[], line: string): boolean {
+  const close = line.indexOf('-->')
+  if (close === -1) return true // still inside the comment: the line goes with it
+  const rest = line.slice(close + 3)
+  // Content trailing the closer keeps its line; a bare closer line is dropped.
+  if (rest.trim().length > 0) out.push(rest.trimStart())
+  return false
+}
+
+/** Fold line-starting HTML comments off `trimmed`; several may share one line.
+ * `allComment` means the line held nothing but comments and whitespace, so it is
+ * dropped; `opensBlock` means the last comment opened a multi-line block. */
+function consumeLineComments(trimmed: string): { allComment: boolean; opensBlock: boolean } {
+  let rest = trimmed
+  let sawComment = false
+  while (rest.startsWith('<!--')) {
+    sawComment = true
+    const close = rest.indexOf('-->')
+    if (close === -1) return { allComment: true, opensBlock: true } // opens a multi-line comment
+    rest = rest.slice(close + 3).trimStart()
+  }
+  return { allComment: sawComment && rest.length === 0, opensBlock: false }
+}
+
 /** Remove whole-line HTML comments, keeping fenced code and inline comments. */
 export function stripBlockComments(text: string): string {
   const out: string[] = []
-  // CommonMark closes a fenced block only with a fence of the same character
-  // that is at least as long as the opener, so both are tracked: a shorter
-  // same-char fence line (the classic 3-backtick block quoted inside a
-  // 4-backtick one) is content, not a closer.
-  let fence: { marker: string; length: number } | null = null
+  let fence: Fence | null = null
   let inComment = false
   for (const line of text.split('\n')) {
     if (inComment) {
-      const close = line.indexOf('-->')
-      if (close === -1) continue // still inside the comment: the line goes with it
-      inComment = false
-      const rest = line.slice(close + 3)
-      // Content trailing the closer keeps its line; a bare closer line is dropped.
-      if (rest.trim().length > 0) out.push(rest.trimStart())
+      inComment = continueOpenComment(out, line)
       continue
     }
     const trimmed = line.trimStart()
-    const marker = fenceMarker(trimmed)
-    if (marker !== null && fence === null) {
-      fence = { marker, length: fenceLength(trimmed, marker) }
+    const step = stepFence(fence, trimmed, fenceMarker(trimmed))
+    fence = step.fence
+    if (step.fenced) {
       out.push(line)
       continue
     }
-    if (fence !== null) {
-      if (marker === fence.marker && fenceLength(trimmed, marker) >= fence.length) fence = null
-      out.push(line) // fenced code, closer included: comments are content, not maintainer notes
-      continue
-    }
-    // Consume comments anchored at the line start; several may share one line.
-    let rest = trimmed
-    let sawComment = false
-    while (rest.startsWith('<!--')) {
-      sawComment = true
-      const close = rest.indexOf('-->')
-      if (close === -1) {
-        inComment = true // opens a multi-line comment
-        rest = ''
-        break
-      }
-      rest = rest.slice(close + 3).trimStart()
-    }
-    if (sawComment && rest.length === 0) continue // the whole line was comment
+    const { allComment, opensBlock } = consumeLineComments(trimmed)
+    if (opensBlock) inComment = true
+    if (allComment) continue // the whole line was comment
     // No comment, or a line-starting comment followed by content: inline, verbatim.
     out.push(line)
   }