pi-lens 4.1.2 → 4.1.4

package/dist/clients/package-manager.js

@@ -18,6 +18,9 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { classifyProbeFailure, createAvailabilityLatch, isTransientDecision, logAvailabilityDecision, startHostStallSampler, } from "./dispatch/runners/utils/availability-policy.js";
 import { safeSpawnAsync } from "./safe-spawn.js";
+import { createAvailabilityProbeFlight } from "./availability-probe-flight.js";
+import { createGenerationSource, } from "./generation-guard.js";
+import { isAtOrAboveHomeDir, walkUpDirs } from "./path-utils.js";
 /**
  * Fallback preference when nothing is declared (or the declared manager is
  * missing). npm first for maximum compatibility; bun last. A project lockfile
@@ -29,6 +32,7 @@ const PREFERENCE = [
     "yarn",
     "bun",
 ];
+const packageManagerProbeFlights = createAvailabilityProbeFlight();
 function onWindows() {
     return process.platform === "win32";
 }
@@ -94,7 +98,6 @@ const PROBE_TIMEOUT_MS = 5_000;
  * a timeout, abort or host stall expires on a cooldown and is re-probed.
  */
 const availabilityLatches = new Map();
-const inFlightProbes = new Map();
 function getLatch(pm) {
     let latch = availabilityLatches.get(pm);
     if (!latch) {
@@ -128,6 +131,7 @@ async function probeAvailability(pm) {
             latched: true,
             hostStallMs,
             budgetMs: PROBE_TIMEOUT_MS,
+            classifiedBy: "probe",
         });
         return true;
     }
@@ -181,22 +185,8 @@ function isAvailable(pm, onTransient) {
         return Promise.resolve(reportIfTransient(memo));
     // A verdict can now expire, so concurrent callers arriving just after a
     // cooldown must share ONE probe rather than each spawning their own.
-    const inFlight = inFlightProbes.get(pm);
-    if (inFlight)
-        return inFlight.then(reportIfTransient);
-    // #1653 review F1: a probe started before a session reset can settle AFTER
-    // a later session's own probe for the same manager is already in flight.
-    // An unconditional delete-by-key would evict that NEWER entry out from
-    // under it, so a third caller in the gap finds nothing in-flight and
-    // spawns a duplicate. Only remove the entry if it is still THIS call's
-    // promise — the same identity guard `resolveMadge` uses in
-    // dependency-checker.ts for the equivalent race.
-    const probe = probeAvailability(pm).finally(() => {
-        if (inFlightProbes.get(pm) === probe)
-            inFlightProbes.delete(pm);
-    });
-    inFlightProbes.set(pm, probe);
-    return probe.then(reportIfTransient);
+    const shared = packageManagerProbeFlights.run(`package-manager:${pm}`, () => probeAvailability(pm));
+    return shared.promise.then(reportIfTransient);
 }
 /**
  * Clear the process-wide availability cache: pnpm/yarn/bun/npm each sit
@@ -209,11 +199,16 @@ function isAvailable(pm, onTransient) {
  * day, start a fresh session, pi-lens still reports it missing until a
  * process restart (#1653). Called from `handleSessionStart`'s per-session
  * reset block beside `resetZizmorTokenAvailability()` /
- * `resetPsScriptAnalyzerAvailability()`; also used directly by tests.
+ * `resetPsScriptAnalyzerAvailability()`; also used directly by tests. Also
+ * clears `globalBinDirCache`, whose memo lifetime rides the same reset — it
+ * must not outlive the availability verdicts it was derived from (#1602).
  */
 export function _resetPackageManagerCache() {
+    packageManagerCacheGeneration.bump();
     availabilityLatches.clear();
-    inFlightProbes.clear();
+    packageManagerProbeFlights.clear();
+    globalBinDirCache.clear();
+    globalBinDirProbeFlights.clear();
 }
 // ============================================================================
 // RESOLUTION
@@ -323,12 +318,39 @@ export function execArgs(pm, pkg, args = []) {
 // ============================================================================
 // GLOBAL BIN DISCOVERY
 // ============================================================================
+/**
+ * Per-manager global bin dir, memoized for the process (cleared alongside
+ * `availabilityLatches` in `_resetPackageManagerCache`). Only a SUCCESSFUL
+ * lookup is cached: a spawn failure here is evidence about this call, not
+ * about the manager (the manager already passed `isAvailable`'s own probe),
+ * so it must not latch an empty result the way a genuine absence would. The
+ * generation guard owns post-await cache publication, so a probe crossing
+ * a session reset cannot repopulate the fresh memo. Reset clears the flight
+ * map separately, so later callers cannot share the pre-reset probe.
+ */
+const globalBinDirCache = new Map();
+const packageManagerCacheGeneration = createGenerationSource("package-manager-global-bin");
+const globalBinDirProbeFlights = createAvailabilityProbeFlight();
 /** Directories where a given manager installs global binaries. */
 async function globalBinDirsFor(pm) {
+    const cached = globalBinDirCache.get(pm);
+    if (cached)
+        return cached;
+    const generation = packageManagerCacheGeneration.capture();
+    // Concurrent callers (dispatch runs several tools per edit) must share ONE
+    // probe rather than each spawning their own `npm config get prefix` (#1602).
+    const shared = globalBinDirProbeFlights.run(pm, () => probeGlobalBinDirs(pm, generation));
+    return shared.promise;
+}
+async function probeGlobalBinDirs(pm, generation) {
     if (pm === "bun") {
         // bun has no per-call query cost — the global bin dir is deterministic.
         const base = process.env.BUN_INSTALL || path.join(os.homedir(), ".bun");
-        return [path.join(base, "bin")];
+        const dirs = [path.join(base, "bin")];
+        generation.guardedWrite(pm, () => {
+            globalBinDirCache.set(pm, dirs);
+        });
+        return dirs;
     }
     const query = pm === "npm"
         ? ["config", "get", "prefix"]
@@ -343,10 +365,11 @@ async function globalBinDirsFor(pm) {
         return [];
     // npm reports a prefix; binaries live in `<prefix>/bin` on Unix, `<prefix>`
     // on Windows. pnpm/yarn already print the bin dir directly.
-    if (pm === "npm") {
-        return [onWindows() ? out : path.join(out, "bin")];
-    }
-    return [out];
+    const dirs = pm === "npm" ? [onWindows() ? out : path.join(out, "bin")] : [out];
+    generation.guardedWrite(pm, () => {
+        globalBinDirCache.set(pm, dirs);
+    });
+    return dirs;
 }
 /**
  * Global bin directories for every installed manager, deduped. Used to locate a
@@ -406,31 +429,165 @@ export async function findGlobalBinary(command, windowsExt = ".cmd") {
     return undefined;
 }
 /**
- * Local `node_modules/.bin/<tool>` walking up from `startDir` to the fs root.
+ * The three project-local bin-directory shapes in this repo, most-preferred
+ * first. Exported so every caller passes the SAME constant instead of
+ * re-listing the directory names next to its own copy of the walk — the venv
+ * list alone had three independent spellings before #2544 review F1
+ * (`formatters.ts`, `runner-helpers.ts`'s `createVenvFinder`,
+ * `dead-code-client.ts`'s `venvCandidates`).
+ *
+ * `VENV_BIN_DIRS` lists BOTH the POSIX (`bin`) and Windows (`Scripts`) layouts
+ * unconditionally rather than branching on `process.platform` at module load:
+ * a module-load platform constant cannot be forced per test, so the other
+ * branch is never exercised on the ubuntu lane (defect shape 30). The extra
+ * two `existsSync` calls per directory are the price of a testable list, and
+ * a `.venv/Scripts` on Linux (or `.venv/bin` under msys) resolves correctly
+ * instead of being invisible.
+ */
+export const NODE_MODULES_BIN_DIRS = [
+    path.join("node_modules", ".bin"),
+];
+export const VENDOR_BIN_DIRS = [path.join("vendor", "bin")];
+export const VENV_BIN_DIRS = [
+    path.join(".venv", "bin"),
+    path.join("venv", "bin"),
+    path.join(".venv", "Scripts"),
+    path.join("venv", "Scripts"),
+];
+/**
+ * THE project-local tool-bin walk: yields every `<binDir>/<tool>` that exists
+ * in `startDir` or one of its ancestors, nearest first, stopping at the HOME
+ * ceiling (never the fs root — see below).
+ *
+ * A generator on purpose. {@link findLocalBinUpwards} takes the first match and
+ * the walk suspends there — no ancestor above the hit is ever stat'd, which is
+ * what a per-edit resolver needs — while {@link findLocalBinsUpwards} drains it
+ * for the ast-grep probe sweep, the one caller that legitimately wants every
+ * candidate above `startDir`. One walk body, two arities, no "collect-all"
+ * flag whose disabled half nothing can observe.
+ * `ceiling: false` opts a walk out of the HOME stop entirely (own-install
+ * trees only, see {@link LocalBinWalkOptions.ceiling}); {@link findLocalBinsAt}
+ * / {@link findLocalBinAt} below are the non-walking sibling for callers that
+ * must check exactly one directory and never climb (`createVenvFinder`,
+ * vulture's `venvCandidates`).
+ *
+ * `tools` is a LIST because the sweep callers probe several spellings of the
+ * same tool and the preference order is per-directory: all of a directory's
+ * candidates, in `tools` order, before the parent directory is looked at.
+ *
+ * `binDirs` makes this the ONLY such walker in the repo. Before #2544 there
+ * were SIX copies of this loop — `formatters.ts`'s `findInNodeModules` /
+ * `findInVendorBin` / `findInVenv`, `oxlint.ts`'s `resolveLocalVp`,
+ * `runner-helpers.ts`'s `findNodeBinRoots` and `resolveVendorToolCommand` —
+ * and they had drifted apart: only this one resolved a relative `startDir`,
+ * only this one had the #2514 HOME ceiling, and `vp` was resolved with
+ * OPPOSITE ceiling policies depending on whether `formatters.ts` or `oxlint.ts`
+ * asked (#2544 review F1). They all delegate here now.
+ *
+ * Candidate order is EXT-OUTER, DIR-INNER: on Windows every `binDir` is tried
+ * with `windowsExt` before any is tried with the bare name, matching what the
+ * `.venv/Scripts` walker did before the fold.
+ */
+/**
+ * Expand `tools` into the actual candidate file names for one directory,
+ * EXT-OUTER: on Windows every tool's extended name is tried before any tool's
+ * bare name (`windowsExt === ""` means the caller already spelled every name
+ * it wants — the ast-grep sweep passes `ast-grep.cmd`/`ast-grep.exe`/`ast-grep`
+ * itself in a shell-dependent order this option cannot express).
+ */
+function expandCandidateNames(tools, windowsExt, isWindows) {
+    return isWindows && windowsExt !== ""
+        ? tools.flatMap((tool) => [`${tool}${windowsExt}`, tool])
+        : [...tools];
+}
+/** Every `<dir>/<binDir>/<name>` that exists, for exactly `dir` — no walk. */
+function* matchesInDir(dir, names, binDirs) {
+    for (const name of names) {
+        for (const binDir of binDirs) {
+            const full = path.join(dir, binDir, name);
+            if (fs.existsSync(full))
+                yield full;
+        }
+    }
+}
+function* localBinMatches(tools, startDir, options) {
+    const { windowsExt = ".cmd", homeDir = os.homedir(), binDirs = NODE_MODULES_BIN_DIRS, isWindows = onWindows(), ceiling = true, } = options;
+    const names = expandCandidateNames(tools, windowsExt, isWindows);
+    for (const dir of walkUpDirs(startDir)) {
+        // Tool-resolution walker, not a config lookup (#2514/#2517 policy):
+        // escaping the project upward past HOME means STOP, not keep reading. A
+        // config-file lookup (`findLocalToolConfig`) keeps climbing past HOME
+        // because the underlying tool would find a legitimate global config
+        // there too; a `node_modules/.bin` match found at or above HOME can
+        // never be THIS project's own installed dependency — it is some
+        // unrelated home-level manifest (the pi-extensions bin shim, #2514).
+        // Default-on (not opt-in like `findLocalToolConfig`'s `options.homeDir`)
+        // because there is no legitimate case for this resolver to hand back a
+        // bin from outside the project tree. `ceiling: false` (own-install
+        // walk only, #2544 round 4 F1) skips this check entirely.
+        if (ceiling && isAtOrAboveHomeDir(dir, homeDir))
+            return;
+        yield* matchesInDir(dir, names, binDirs);
+    }
+}
+/**
+ * The nearest project-local `<binDir>/<tool>` at or above `startDir`, or
+ * `undefined`. See {@link localBinMatches} for the walk itself.
  *
  * Exported so callers that must NOT pay for global-bin discovery can reuse this
  * walk instead of copying it. `findNodeToolBinary` below adds `findGlobalBinary`,
  * which spawns a probe per package manager; a caller resolving a command on
  * every run (knip, #1721) needs the filesystem half only.
  */
-export function findLocalBinUpwards(tool, startDir, windowsExt = ".cmd") {
-    const names = onWindows() ? [`${tool}${windowsExt}`, tool] : [tool];
-    let dir = path.resolve(startDir);
-    const root = path.parse(dir).root;
-    while (true) {
-        for (const name of names) {
-            const full = path.join(dir, "node_modules", ".bin", name);
-            if (fs.existsSync(full))
-                return full;
-        }
-        if (dir === root)
-            break;
-        const parent = path.dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    return undefined;
+export function findLocalBinUpwards(tool, startDir, options = {}) {
+    // `.next().value`, not a `for…of` that returns on its first iteration: the
+    // latter is a single-iteration loop (SonarCloud S1751, and it reads as one
+    // too). The generator is simply left suspended after the first match — it
+    // holds no resource that needs closing, which is exactly why the walk above
+    // never stats an ancestor beyond the hit.
+    return localBinMatches([tool], startDir, options).next().value;
+}
+/**
+ * EVERY project-local match for `tools` at or above `startDir`, nearest first.
+ *
+ * For the ast-grep availability sweep (`runner-helpers.ts`'s `buildSgLocalBins`,
+ * which spawns `--version` against each candidate until one answers, both for
+ * the project walk and — with `ceiling: false` — pi-lens's own install-tree
+ * walk), which previously hand-rolled its own unceilinged climb precisely
+ * because the singular `findLocalBinUpwards` could not express "all of them"
+ * (#2544 review F1).
+ *
+ * NOT for a "project's own venv/vendor-bin first" resolver: `createVenvFinder`
+ * and vulture's `venvCandidates` looked like this walk's other two callers in
+ * round 3, but that was an unrequested behaviour change (round 3 introduced
+ * ancestor climbing where a single cwd/root lookup existed before, with no
+ * #2514 defect behind it) — reverted in round 4 F2 to {@link findLocalBinsAt}.
+ */
+export function findLocalBinsUpwards(tools, startDir, options = {}) {
+    return [...localBinMatches(tools, startDir, options)];
+}
+/**
+ * EVERY `<dir>/<binDir>/<tool>` that exists for exactly `dir` — no ancestor
+ * walk, so the HOME ceiling is moot (a single directory can never climb past
+ * it).
+ *
+ * For the "project's own venv/vendor-bin first" resolvers that must NOT climb
+ * to a parent project (#2544 round 4 F2): `createVenvFinder` and vulture's
+ * `venvCandidates` were fixed `cwd`/`root` lookups before #2544 review round 3
+ * converted them into ancestor walks with no reported defect behind the
+ * conversion (an unrelated sibling project's interpreter at `~/code/.venv`
+ * could then outrank PATH for `~/code/app`, which has no venv of its own).
+ * Reverted here; `binDirs`/`windowsExt` stay shared with the walking helpers
+ * above so the three directory shapes have exactly one spelling.
+ */
+export function findLocalBinsAt(tools, dir, options = {}) {
+    const { windowsExt = ".cmd", binDirs = NODE_MODULES_BIN_DIRS, isWindows = onWindows(), } = options;
+    const names = expandCandidateNames(tools, windowsExt, isWindows);
+    return [...matchesInDir(path.resolve(dir), names, binDirs)];
+}
+/** The nearest — i.e. first-listed — `<dir>/<binDir>/<tool>` match, or `undefined`. */
+export function findLocalBinAt(tool, dir, options = {}) {
+    return findLocalBinsAt([tool], dir, options)[0];
 }
 /**
  * Locate a Node CLI tool's binary, preferring a local `node_modules/.bin`
@@ -444,6 +601,6 @@ export function findLocalBinUpwards(tool, startDir, windowsExt = ".cmd") {
  * without changing their npx fallback semantics.
  */
 export async function findNodeToolBinary(tool, cwd, windowsExt = ".cmd") {
-    return (findLocalBinUpwards(tool, cwd, windowsExt) ??
+    return (findLocalBinUpwards(tool, cwd, { windowsExt }) ??
         (await findGlobalBinary(tool, windowsExt)));
 }