pi-codex-auto-review 0.1.1 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +1 -1
- package/dist/sandbox/directory-scan.d.ts +1 -0
- package/dist/sandbox/directory-scan.js +32 -0
- package/dist/sandbox/directory-scan.js.map +1 -0
- package/dist/sandbox/hard-links.js +64 -54
- package/dist/sandbox/hard-links.js.map +1 -1
- package/docs/publishing.md +4 -4
- package/docs/usage.md +4 -2
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -7,7 +7,7 @@ Codex의 ‘Approve for me’에서 영감을 받은 Pi 자동 실행 승인 검
|
|
|
7
7
|
npm에 게시된 버전은 Pi에서 설치합니다. 배포 패키지는 macOS ARM64와 Linux x64용 규칙 엔진을 포함하며, 설치할 때 Rust 빌드가 필요하지 않습니다.
|
|
8
8
|
|
|
9
9
|
```sh
|
|
10
|
-
pi install npm:pi-codex-auto-review@0.1.
|
|
10
|
+
pi install npm:pi-codex-auto-review@0.1.2
|
|
11
11
|
pi list
|
|
12
12
|
```
|
|
13
13
|
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
export {};
|
|
@@ -0,0 +1,32 @@
|
|
|
1
|
+
import { readFileSync, readdirSync } from 'node:fs';
|
|
2
|
+
import { join, sep } from 'node:path';
|
|
3
|
+
import { isWithin } from '../policy/paths.js';
|
|
4
|
+
// Internal metadata-only child. The parent supplies canonical, disjoint roots
|
|
5
|
+
// and owns cancellation, the time budget and the bounded output buffer.
|
|
6
|
+
const { roots, denied } = JSON.parse(readFileSync(0, 'utf8'));
|
|
7
|
+
const unlistable = [];
|
|
8
|
+
for (const root of roots) {
|
|
9
|
+
const exclusions = denied.filter(path => isWithin(path, root));
|
|
10
|
+
const pending = [root];
|
|
11
|
+
while (pending.length) {
|
|
12
|
+
const path = pending.pop();
|
|
13
|
+
if (exclusions.some(root => path === root || path.startsWith(root + sep)))
|
|
14
|
+
continue;
|
|
15
|
+
try {
|
|
16
|
+
for (const entry of readdirSync(path, { withFileTypes: true })) {
|
|
17
|
+
if (entry.isDirectory())
|
|
18
|
+
pending.push(join(path, entry.name));
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
catch (error) {
|
|
22
|
+
const code = error.code;
|
|
23
|
+
if (code === 'ENOENT' || code === 'ENOTDIR')
|
|
24
|
+
continue;
|
|
25
|
+
if (code !== 'EACCES' && code !== 'EPERM')
|
|
26
|
+
throw error;
|
|
27
|
+
unlistable.push(path);
|
|
28
|
+
}
|
|
29
|
+
}
|
|
30
|
+
}
|
|
31
|
+
process.stdout.write(JSON.stringify(unlistable));
|
|
32
|
+
//# sourceMappingURL=directory-scan.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"directory-scan.js","sourceRoot":"","sources":["../../src/sandbox/directory-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,8EAA8E;AAC9E,wEAAwE;AACxE,MAAM,EAAC,KAAK,EAAC,MAAM,EAAC,GAAqC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,EAAC,MAAM,CAAC,CAAC,CAAC;AAC5F,MAAM,UAAU,GAAa,EAAE,CAAC;AAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAG,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;YAAE,SAAS;QACpF,IAAI,CAAC;YACH,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,EAAC,EAAC,aAAa,EAAC,IAAI,EAAC,CAAC,EAAE,CAAC;gBAC3D,IAAI,KAAK,CAAC,WAAW,EAAE;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/D,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;YACnD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAS;YACtD,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,OAAO;gBAAE,MAAM,KAAK,CAAC;YACvD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;AACH,CAAC;AACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC"}
|
|
@@ -1,12 +1,13 @@
|
|
|
1
|
-
import { access, lstat,
|
|
1
|
+
import { access, lstat, realpath } from 'node:fs/promises';
|
|
2
2
|
import { constants } from 'node:fs';
|
|
3
3
|
import { execFile } from 'node:child_process';
|
|
4
4
|
import { promisify } from 'node:util';
|
|
5
|
-
import {
|
|
5
|
+
import { parse } from 'node:path';
|
|
6
|
+
import { fileURLToPath } from 'node:url';
|
|
6
7
|
import { GuardError } from '../contracts.js';
|
|
7
8
|
import { isWithin } from '../policy/paths.js';
|
|
8
9
|
const MAX_SCAN_MS = 30000;
|
|
9
|
-
const
|
|
10
|
+
const runScan = promisify(execFile);
|
|
10
11
|
const isMissing = (error) => ['ENOENT', 'ENOTDIR'].includes(error.code ?? '');
|
|
11
12
|
async function existingRoots(paths) {
|
|
12
13
|
const values = [];
|
|
@@ -30,42 +31,42 @@ export async function assertHardLinkBoundaries(profile, delta, config, signal) {
|
|
|
30
31
|
throw new GuardError('HARD_LINK_SCAN_LIMIT', 'The filesystem is too large to qualify hard-link boundaries safely');
|
|
31
32
|
};
|
|
32
33
|
const scanned = new Map();
|
|
34
|
+
const directoryScans = new Map();
|
|
33
35
|
const opaqueDirectories = async (paths, exclusions) => {
|
|
34
|
-
const
|
|
35
|
-
|
|
36
|
+
const denied = await existingRoots(exclusions);
|
|
37
|
+
const roots = (await existingRoots(paths)).filter(root => root !== parse(root).root && !denied.some(path => isWithin(root, path)));
|
|
38
|
+
if (!roots.length)
|
|
39
|
+
return [];
|
|
40
|
+
const prune = denied.filter(path => roots.some(root => isWithin(path, root)));
|
|
41
|
+
const key = JSON.stringify([roots.toSorted(), prune.toSorted()]);
|
|
42
|
+
if (directoryScans.has(key))
|
|
43
|
+
return directoryScans.get(key);
|
|
44
|
+
check();
|
|
45
|
+
// Synchronous directory I/O avoids a promise per directory. Keep it in an
|
|
46
|
+
// owned process so the shared deadline and caller cancellation stay effective.
|
|
47
|
+
const scan = runScan(process.execPath, [fileURLToPath(new URL('./directory-scan.js', import.meta.url))], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024, timeout: Math.max(1, deadlineMs - Date.now()), killSignal: 'SIGKILL', signal, env: {} });
|
|
48
|
+
scan.child.stdin.on('error', () => { });
|
|
49
|
+
scan.child.stdin.end(JSON.stringify({ roots, denied: prune }));
|
|
50
|
+
const { stdout } = await scan;
|
|
51
|
+
const unlistable = JSON.parse(stdout);
|
|
52
|
+
if (!Array.isArray(unlistable) || unlistable.some(path => typeof path !== 'string' || path.includes('\0') || !roots.some(root => isWithin(path, root))))
|
|
53
|
+
throw new GuardError('HARD_LINK_SCAN_FAILED', 'Invalid directory scan output');
|
|
54
|
+
const result = [];
|
|
55
|
+
for (const path of unlistable) {
|
|
36
56
|
check();
|
|
37
|
-
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
if (isMissing(error))
|
|
49
|
-
return;
|
|
50
|
-
if (['EACCES', 'EPERM'].includes(error.code ?? '')) {
|
|
51
|
-
const isSearchable = await access(path, constants.X_OK).then(() => true, error => { if (['EACCES', 'EPERM'].includes(error.code ?? ''))
|
|
52
|
-
return false; throw error; });
|
|
53
|
-
if (!isSearchable) {
|
|
54
|
-
if (/[?*[\]{}]/.test(path))
|
|
55
|
-
throw new GuardError('NATIVE_SCOPE_UNSUPPORTED', 'An opaque directory cannot be represented safely in the native profile');
|
|
56
|
-
result.push(path);
|
|
57
|
-
return;
|
|
58
|
-
}
|
|
59
|
-
}
|
|
60
|
-
// An unlistable but searchable directory can still expose known filenames.
|
|
61
|
-
throw error;
|
|
62
|
-
}
|
|
63
|
-
check();
|
|
64
|
-
for (const entry of entries)
|
|
65
|
-
if (entry.isDirectory())
|
|
66
|
-
pending.push(join(path, entry.name));
|
|
67
|
-
}));
|
|
57
|
+
const isSearchable = await access(path, constants.X_OK).then(() => true, error => {
|
|
58
|
+
if (['EACCES', 'EPERM'].includes(error.code ?? ''))
|
|
59
|
+
return false;
|
|
60
|
+
throw error;
|
|
61
|
+
});
|
|
62
|
+
// An unlistable but searchable directory can still expose known filenames.
|
|
63
|
+
if (isSearchable)
|
|
64
|
+
throw new GuardError('HARD_LINK_SCAN_FAILED', 'A searchable directory could not be inspected safely');
|
|
65
|
+
if (/[?*[\]{}]/.test(path))
|
|
66
|
+
throw new GuardError('NATIVE_SCOPE_UNSUPPORTED', 'An opaque directory cannot be represented safely in the native profile');
|
|
67
|
+
result.push(path);
|
|
68
68
|
}
|
|
69
|
+
directoryScans.set(key, result);
|
|
69
70
|
return result;
|
|
70
71
|
};
|
|
71
72
|
const inspect = async (paths, exclusions = []) => {
|
|
@@ -73,42 +74,51 @@ export async function assertHardLinkBoundaries(profile, delta, config, signal) {
|
|
|
73
74
|
// Every name is already in scope when the filesystem root is admitted (or denied).
|
|
74
75
|
if (roots.some(root => root === parse(root).root) && denied.length === 0)
|
|
75
76
|
return;
|
|
76
|
-
const
|
|
77
|
+
const admitted = roots.filter(path => !denied.some(root => isWithin(path, root)));
|
|
78
|
+
if (!admitted.length)
|
|
79
|
+
return;
|
|
80
|
+
const prune = denied.filter(path => admitted.some(root => isWithin(path, root)));
|
|
81
|
+
// Read/write passes with the same effective subtree share one qualification.
|
|
82
|
+
const key = JSON.stringify([admitted.toSorted(), prune.toSorted()]);
|
|
77
83
|
if (scanned.has(key))
|
|
78
84
|
return scanned.get(key);
|
|
79
85
|
const scan = async () => {
|
|
80
|
-
const admitted = roots.filter(path => !denied.some(root => isWithin(path, root)));
|
|
81
|
-
if (!admitted.length)
|
|
82
|
-
return;
|
|
83
86
|
// Native find performs the metadata traversal without one JS promise/stat per ordinary file.
|
|
84
87
|
// Arguments are passed directly (no shell); NUL framing preserves spaces/newlines in names.
|
|
85
|
-
const prune = denied.filter(path => admitted.some(root => isWithin(path, root)));
|
|
86
88
|
const escapePattern = (path) => path.replace(/[?*\[\]\\]/g, '\\$&');
|
|
87
89
|
const terms = prune.flatMap((path, index) => [...(index ? ['-o'] : []), '-path', escapePattern(path)]);
|
|
88
90
|
const args = [...admitted, ...(terms.length ? ['(', ...terms, ')', '-prune', '-o'] : []), '-type', 'f', '-links', '+1', '-print0'];
|
|
89
91
|
check();
|
|
90
|
-
const { stdout } = await
|
|
92
|
+
const { stdout } = await runScan('/usr/bin/find', args, { encoding: 'buffer', maxBuffer: 16 * 1024 * 1024, timeout: Math.max(1, deadlineMs - Date.now()), killSignal: 'SIGKILL', signal, env: {} });
|
|
91
93
|
const names = [];
|
|
92
94
|
for (let start = 0, end = stdout.indexOf(0); end >= 0; start = end + 1, end = stdout.indexOf(0, start))
|
|
93
95
|
names.push(stdout.subarray(start, end));
|
|
94
96
|
if (stdout.length && stdout.at(-1) !== 0)
|
|
95
97
|
throw new GuardError('HARD_LINK_SCAN_FAILED', 'Incomplete hard-link scan output');
|
|
96
98
|
const links = new Map();
|
|
97
|
-
for (
|
|
99
|
+
for (let start = 0; start < names.length; start += 64) {
|
|
98
100
|
check();
|
|
99
|
-
const
|
|
100
|
-
|
|
101
|
-
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
|
|
101
|
+
const batch = names.slice(start, start + 64);
|
|
102
|
+
const metadata = await Promise.all(batch.map(path => lstat(path)));
|
|
103
|
+
for (const [index, info] of metadata.entries()) {
|
|
104
|
+
if (!info.isFile() || info.nlink < 2)
|
|
105
|
+
throw new GuardError('HARD_LINK_CHANGED', 'Hard-link topology changed during qualification');
|
|
106
|
+
const inode = `${info.dev}:${info.ino}`, prior = links.get(inode);
|
|
107
|
+
if (prior && prior.nlink !== info.nlink)
|
|
108
|
+
throw new GuardError('HARD_LINK_CHANGED', 'Hard-link topology changed during qualification');
|
|
109
|
+
links.set(inode, { count: (prior?.count ?? 0) + 1, nlink: info.nlink, path: batch[index] });
|
|
110
|
+
}
|
|
106
111
|
}
|
|
107
|
-
|
|
112
|
+
const values = [...links.values()];
|
|
113
|
+
for (let start = 0; start < values.length; start += 64) {
|
|
108
114
|
check();
|
|
109
|
-
const
|
|
110
|
-
|
|
111
|
-
|
|
115
|
+
const batch = values.slice(start, start + 64);
|
|
116
|
+
const metadata = await Promise.all(batch.map(value => lstat(value.path)));
|
|
117
|
+
for (const [index, info] of metadata.entries()) {
|
|
118
|
+
const value = batch[index];
|
|
119
|
+
if (value.count !== value.nlink || info.nlink !== value.nlink)
|
|
120
|
+
throw new GuardError('HARD_LINK_BOUNDARY', 'A pre-existing hard link crosses the admitted filesystem boundary');
|
|
121
|
+
}
|
|
112
122
|
}
|
|
113
123
|
};
|
|
114
124
|
const pending = scan();
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"hard-links.js","sourceRoot":"","sources":["../../src/sandbox/hard-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,
|
|
1
|
+
{"version":3,"file":"hard-links.js","sourceRoot":"","sources":["../../src/sandbox/hard-links.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,UAAU,EAAgD,MAAM,iBAAiB,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,MAAM,WAAW,GAAG,KAAK,CAAC;AAC1B,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AACpC,MAAM,SAAS,GAAG,CAAC,KAAc,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAC,SAAS,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACjH,KAAK,UAAU,aAAa,CAAC,KAAwB;IACnD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,MAAM,KAAK,CAAC;QAAC,CAAC;IAClG,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACtH,CAAC;AACD,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAA0B,EAAE,KAAsB,EAAE,MAA4B,EAAE,MAAmB;IAClJ,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,MAAM,CAAC,cAAc,EAAE,CAAC;QACxB,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;YAAE,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,oEAAoE,CAAC,CAAC;IAClJ,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAyB,CAAC;IACjD,MAAM,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnD,MAAM,iBAAiB,GAAG,KAAK,EAAE,KAAwB,EAAE,UAA6B,EAAE,EAAE;QAC1F,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,CAAC,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClI,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QAChE,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,cAAc,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAC7D,KAAK,EAAE,CAAC;QACR,0EAA0E;QAC1E,+EAA+E;QAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAC,CAAC,aAAa,CAAC,IAAI,GAAG,CAAC,qBAAqB,EAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAC,EAAC,QAAQ,EAAC,MAAM,EAAC,SAAS,EAAC,EAAE,GAAC,IAAI,GAAC,IAAI,EAAC,OAAO,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,UAAU,GAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,CAAC,CAAC;QAC7N,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,EAAE,CAAC,OAAO,EAAC,GAAE,EAAE,GAAC,CAAC,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAC,KAAK,EAAC,MAAM,EAAC,KAAK,EAAC,CAAC,CAAC,CAAC;QAC5D,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,IAAI,CAAC;QAC5B,MAAM,UAAU,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAC,+BAA+B,CAAC,CAAC;QACtO,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,MAAM,IAAI,IAAI,UAAsB,EAAE,CAAC;YAC1C,KAAK,EAAE,CAAC;YACR,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,IAAI,EAAC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAE,EAAE,CAAA,IAAI,EAAC,KAAK,CAAA,EAAE;gBAC1E,IAAI,CAAC,QAAQ,EAAC,OAAO,CAAC,CAAC,QAAQ,CAAE,KAA+B,CAAC,IAAI,IAAE,EAAE,CAAC;oBAAE,OAAO,KAAK,CAAC;gBACzF,MAAM,KAAK,CAAC;YACd,CAAC,CAAC,CAAC;YACH,2EAA2E;YAC3E,IAAI,YAAY;gBAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAC,sDAAsD,CAAC,CAAC;YACvH,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,0BAA0B,EAAC,wEAAwE,CAAC,CAAC;YACtJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,cAAc,CAAC,GAAG,CAAC,GAAG,EAAC,MAAM,CAAC,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,KAAK,EAAE,KAAwB,EAAE,aAAgC,EAAE,EAAE,EAAE;QACrF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,CAAC,CAAC;QACnF,mFAAmF;QACnF,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QACjF,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,MAAM;YAAE,OAAO;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,6EAA6E;QAC7E,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;YACtB,6FAA6F;YAC7F,4FAA4F;YAC5F,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;YAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACtG,MAAM,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,EAAC,GAAG,KAAK,EAAC,GAAG,EAAC,QAAQ,EAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAC,GAAG,EAAC,QAAQ,EAAC,IAAI,EAAC,SAAS,CAAC,CAAC;YAC3H,KAAK,EAAE,CAAC;YACR,MAAM,EAAC,MAAM,EAAC,GAAG,MAAM,OAAO,CAAC,eAAe,EAAC,IAAI,EAAC,EAAC,QAAQ,EAAC,QAAQ,EAAC,SAAS,EAAC,EAAE,GAAC,IAAI,GAAC,IAAI,EAAC,OAAO,EAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAC,UAAU,GAAC,IAAI,CAAC,GAAG,EAAE,CAAC,EAAC,UAAU,EAAC,SAAS,EAAC,MAAM,EAAC,GAAG,EAAC,EAAE,EAAC,CAAC,CAAC;YAC7K,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,KAAK,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,EAAC,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAC,GAAG,CAAC,CAAC,CAAC;YAC9I,IAAI,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAC,kCAAkC,CAAC,CAAC;YAC3H,MAAM,KAAK,GAAG,IAAI,GAAG,EAAoD,CAAC;YAC1E,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACtD,KAAK,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAC,KAAK,GAAC,EAAE,CAAC,CAAC;gBAC1C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnE,KAAK,MAAM,CAAC,KAAK,EAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC9C,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;wBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAC,iDAAiD,CAAC,CAAC;oBAClI,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;oBAClE,IAAI,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;wBAAE,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAC,iDAAiD,CAAC,CAAC;oBACrI,KAAK,CAAC,GAAG,CAAC,KAAK,EAAC,EAAC,KAAK,EAAC,CAAC,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,GAAC,CAAC,EAAC,KAAK,EAAC,IAAI,CAAC,KAAK,EAAC,IAAI,EAAC,KAAK,CAAC,KAAK,CAAE,EAAC,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YACnC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;gBACvD,KAAK,EAAE,CAAC;gBACR,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,EAAC,KAAK,GAAC,EAAE,CAAC,CAAC;gBAC3C,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC1E,KAAK,MAAM,CAAC,KAAK,EAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;oBAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;oBAC5B,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;wBAAE,MAAM,IAAI,UAAU,CAAC,oBAAoB,EAAE,mEAAmE,CAAC,CAAC;gBACjL,CAAC;YACH,CAAC;QACH,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;QAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAC,OAAO,CAAC,CAAC;QAAC,MAAM,OAAO,CAAC;IAClE,CAAC,CAAC;IACF,IAAI,CAAC;QACH,+EAA+E;QAC/E,MAAM,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,EAAC,GAAG,KAAK,CAAC,SAAS,EAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAC,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,IAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAA,EAAE,CAAA,IAAI,KAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QACrI,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,UAAU,IAAI,EAAE,EAAE,WAAW,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,IAAI,EAAE,CAAC;QACnG,MAAM,MAAM,GAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAA,CAAC,CAAA,EAAE,CAAA,CAAC,CAAA,MAAM,iBAAiB,CAAC,KAAK,EAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAAC,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QAChJ,yFAAyF;QACzF,8EAA8E;QAC9E,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,IAAE,EAAE,CAAC,EAAC,GAAG,MAAM,CAAC,CAAC;QAC3E,MAAM,CAAC,UAAU,CAAC,SAAS,GAAC,CAAC,GAAG,WAAW,EAAC,GAAG,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,WAAW;YAAE,MAAM,OAAO,CAAC,KAAK,EAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,EAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QACvE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClB,IAAI,CAAC,MAAM,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;gBAAE,MAAM,OAAO,CAAC,WAAW,CAAC,CAAC;;gBACjG,MAAM,OAAO,CAAC,MAAM,EAAC,CAAC,GAAG,WAAW,EAAC,GAAG,MAAM,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,KAAK,EAAE,CAAC;IACV,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,UAAU,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,KAAK,CAAC;QAC/D,MAAM,IAAI,UAAU,CAAC,uBAAuB,EAAE,uEAAuE,EAAE,EAAC,KAAK,EAAC,KAAK,EAAC,CAAC,CAAC;IACxI,CAAC;AACH,CAAC"}
|
package/docs/publishing.md
CHANGED
|
@@ -40,7 +40,7 @@ npm ci --ignore-scripts
|
|
|
40
40
|
pnpm release
|
|
41
41
|
```
|
|
42
42
|
|
|
43
|
-
1. 현재 버전과 구체적인 다음 버전을 보고 하나를 선택합니다. 로컬 버전 태그가 없으면 **현재 준비 버전 출시**도 선택할 수 있습니다.
|
|
43
|
+
1. 현재 버전과 구체적인 다음 버전을 보고 하나를 선택합니다. `0.1.1`에서 `0.1.2`를 출시할 때는 **patch**를 선택합니다. 로컬 버전 태그가 없으면 **현재 준비 버전 출시**도 선택할 수 있습니다.
|
|
44
44
|
2. 커밋 여부를 확인하고 릴리스 커밋을 만듭니다. 현재 버전을 그대로 출시할 때는 출시 기록을 남기는 빈 커밋을 만듭니다.
|
|
45
45
|
3. `v<버전>` 태그 생성 여부를 확인하고 주석 태그를 만듭니다.
|
|
46
46
|
4. `master`와 해당 태그의 푸시 여부를 확인합니다. 승인하면 두 참조를 원자적으로 함께 푸시하고 Actions의 npm 게시를 시작합니다.
|
|
@@ -81,11 +81,11 @@ git ls-remote origin refs/heads/master 'refs/tags/v*'
|
|
|
81
81
|
|
|
82
82
|
## 게시 결과와 Pi 설치 확인
|
|
83
83
|
|
|
84
|
-
|
|
84
|
+
`0.1.2` 게시 후 다음 명령으로 확인합니다.
|
|
85
85
|
|
|
86
86
|
```sh
|
|
87
|
-
npm view pi-codex-auto-review@0.1.
|
|
88
|
-
pi install npm:pi-codex-auto-review@0.1.
|
|
87
|
+
npm view pi-codex-auto-review@0.1.2 version --registry=https://registry.npmjs.org/
|
|
88
|
+
pi install npm:pi-codex-auto-review@0.1.2
|
|
89
89
|
pi list
|
|
90
90
|
pi
|
|
91
91
|
```
|
package/docs/usage.md
CHANGED
|
@@ -7,14 +7,16 @@ pi-codex-auto-review를 Pi 확장으로 등록하는 방법과 CLI·SDK·정책
|
|
|
7
7
|
npm에 게시된 버전은 Node.js 22.19 이상과 Pi 0.99.1 또는 1.0.0에서 설치합니다. 배포 대상은 macOS ARM64와 Linux x64이며, 패키지에 두 플랫폼의 규칙 엔진을 포함하므로 설치할 때 Rust가 필요하지 않습니다. 운영체제 샌드박스가 사용할 수 있는 환경이어야 하며 Windows의 네이티브 격리는 지원하지 않습니다.
|
|
8
8
|
|
|
9
9
|
```sh
|
|
10
|
-
pi install npm:pi-codex-auto-review@0.1.
|
|
10
|
+
pi install npm:pi-codex-auto-review@0.1.2
|
|
11
11
|
pi list
|
|
12
12
|
pi remove npm:pi-codex-auto-review
|
|
13
13
|
```
|
|
14
14
|
|
|
15
15
|
`--local`을 추가하면 현재 프로젝트의 `.pi/settings.json`에 등록합니다. 프로젝트 패키지는 해당 프로젝트의 신뢰 결정 후 로드됩니다. 버전을 명시한 설치는 그 버전으로 고정됩니다.
|
|
16
16
|
|
|
17
|
-
0.1.0에서 `Cannot find package '@earendil-works/pi-coding-agent'`로 시작에 실패하면 0.1.
|
|
17
|
+
0.1.0에서 `Cannot find package '@earendil-works/pi-coding-agent'`로 시작에 실패하면 0.1.2로 업데이트합니다. Pi는 관리하는 확장에 호스트 SDK의 물리적 복사본을 설치하지 않습니다. 0.1.1부터 Pi의 공개 경로 API로 호스트 SDK를 찾고, 그 절대 경로를 격리 워커에도 전달합니다. 별도의 SDK 복사본이나 심볼릭 링크를 추가할 필요가 없습니다.
|
|
18
|
+
|
|
19
|
+
0.1.1에서 `Directory metadata scope is too large to qualify safely`로 시작에 실패해도 0.1.2로 업데이트합니다. 0.1.2는 별도 프로세스에서 디렉터리 메타데이터를 탐색하며, 10만 개 제한을 제거합니다. 기본 `/tmp`·`TMPDIR`의 쓰기 범위와 하드링크 보호, 30초 검사 제한 및 취소 처리는 유지합니다. 검사에 실패하거나 제한 시간을 초과하면 실행을 차단합니다.
|
|
18
20
|
|
|
19
21
|
기본 설치 위치인 `.pi/agent/npm` 안에서도 실행에 필요한 확장 코드와 의존성을 읽을 수 있습니다. 에이전트 설정과 자격 증명 경로의 보호는 유지합니다.
|
|
20
22
|
|
package/package.json
CHANGED