pi-lens 4.2.1 → 4.4.0

package/dist/clients/project-trust.js

@@ -1,181 +0,0 @@
-/**
- * Host project-trust gate (#1334 S5).
- *
- * pi decides project trust itself: an extension may *answer* the question by
- * registering `pi.on("project_trust", handler)` (returning
- * `{ trusted: "yes" | "no" | "undecided" }`), but every other extension simply
- * *consumes* the outcome through `ExtensionContext.isProjectTrusted()`. pi-lens
- * is a consumer — it must never register the handler and answer the trust
- * question on the user's behalf.
- *
- * Verified against the pinned host types
- * (`@earendil-works/pi-coding-agent/dist/core/extensions/types.d.ts`):
- *   - `ExtensionContext.isProjectTrusted(): boolean`  (line 234)
- *   - `ProjectTrustEventDecision = "yes" | "no" | "undecided"`  (line 390)
- *
- * Note the asymmetry: the *event* has a three-valued decision, but the *ctx*
- * accessor collapses it to a boolean. So the only distinctions pi-lens can make
- * are "host says trusted", "host says NOT trusted", and "host gave no signal at
- * all" (older hosts with no `isProjectTrusted` on the ctx).
- *
- * Policy:
- *   - `untrusted` — the host said no or its accessor failed. Block every
- *     install/materialization path (including npx and grammar WASM downloads)
- *     and LSP child process spawn. Discovery and cached/in-process analysis
- *     continue; a missing grammar follows its unavailable path.
- *   - `trusted` / `unknown` — current behavior, unchanged. Fail-open is
- *     deliberate ONLY for `unknown`: a host that never exposed the accessor
- *     never had a trust decision to honor, and degrading it would break every
- *     older pi.
- *
- * Process-wide singleton on purpose: `ensureTool()` and the LSP service sit
- * many layers below any `ctx`, and threading trust through every call site
- * would be a far larger and more fragile change than a single latched state
- * refreshed on each `session_start` and `turn_start`.
- */
-import { logExtension } from "./extension-log.js";
-import { recordDegradation } from "./degradation-ledger.js";
-let trustState = "unknown";
-const installRefusalWarnings = new Set();
-// Bounded (#1363 review): dynamic contexts (per-formatter/per-server strings)
-// must not grow without limit across a long untrusted session. Clearing on
-// overflow trades an occasional repeat warning for bounded memory.
-const INSTALL_REFUSAL_WARNING_CAP = 200;
-// Monotonic transition counter (#1363 review): consumers needing
-// clear-on-transition semantics compare this lazily at use time instead of
-// registering callbacks -- a per-instance listener with no teardown path
-// strongly retains every instance ever constructed.
-let trustGeneration = 0;
-export function getProjectTrustGeneration() {
-    return trustGeneration;
-}
-function latchProjectTrustState(next) {
-    if (next === trustState)
-        return;
-    trustState = next;
-    installRefusalWarnings.clear();
-    trustGeneration += 1;
-}
-/**
- * Feature-detected read of the host trust decision off an event ctx.
- *
- * Returns `"unknown"` when the host predates the accessor, when the accessor
- * throws, or when it returns a non-boolean — never guesses "untrusted" from a
- * missing surface, because that would silently disable pi-lens on every older
- * host.
- */
-export function readProjectTrustFromContext(ctx) {
-    try {
-        const accessor = ctx
-            ?.isProjectTrusted;
-        if (typeof accessor !== "function")
-            return "unknown";
-        const trusted = accessor.call(ctx);
-        if (typeof trusted !== "boolean")
-            return "unknown";
-        return trusted ? "trusted" : "untrusted";
-    }
-    catch (accessorErr) {
-        // The accessor exists, so this is not the absent older-host signal. If it
-        // fails, executable content must remain gated until a later adoption works.
-        // Log it (#1350 delta review): a host whose accessor throws on every call
-        // permanently gates installs/LSP, and without this line the only trace is
-        // indirect refusal logs.
-        logExtension({
-            subsystem: "project-trust",
-            level: "warn",
-            message: "isProjectTrusted() threw -- latching untrusted (fail-closed)",
-            metadata: { error: String(accessorErr) },
-        });
-        return "untrusted";
-    }
-}
-/** Latch a trust state directly (tests, and the ctx adoption path below). */
-export function setProjectTrustState(next) {
-    const previous = trustState;
-    latchProjectTrustState(next);
-    if (previous !== next) {
-        logExtension({
-            subsystem: "project-trust",
-            level: "debug",
-            message: `project trust state transitioned: ${previous} -> ${next}`,
-            metadata: { previous, next },
-        });
-    }
-}
-/**
- * Read the host decision off `ctx` and latch it. Called from `session_start`,
- * which fires again on fork/reload/resume — a re-read per session start is
- * exactly right, since the cwd (and therefore the trust decision) can change.
- */
-export function adoptProjectTrustFromContext(ctx) {
-    const next = readProjectTrustFromContext(ctx);
-    const previous = trustState;
-    latchProjectTrustState(next);
-    if (previous !== next) {
-        logExtension({
-            subsystem: "project-trust",
-            level: "debug",
-            message: `project trust state transitioned: ${previous} -> ${next}`,
-            metadata: { previous, next },
-        });
-    }
-    return next;
-}
-/** Adopt through the canonical host capability boundary. */
-export function adoptProjectTrustFromPorts(ports) {
-    const next = ports.trust.isProjectTrusted();
-    setProjectTrustState(next);
-    return next;
-}
-export function getProjectTrustState() {
-    return trustState;
-}
-/** Test/teardown-only: back to the fail-open default. */
-export function resetProjectTrust() {
-    latchProjectTrustState("unknown");
-    installRefusalWarnings.clear();
-}
-/**
- * False only when the host actively denied trust. Gates tool auto-install
- * (download + execute), never plain discovery of an already-present binary.
- */
-export function isToolInstallAllowedByTrust() {
-    return trustState !== "untrusted";
-}
-/** Central gate for operations that may download or install executable content. */
-export function assertInstallAllowed(context) {
-    if (isToolInstallAllowedByTrust())
-        return true;
-    recordDegradation({
-        kind: "trust-refusal",
-        subject: context,
-        reason: projectTrustDenialReason() ?? "project trust denied",
-    });
-    if (!installRefusalWarnings.has(context)) {
-        if (installRefusalWarnings.size >= INSTALL_REFUSAL_WARNING_CAP) {
-            installRefusalWarnings.clear();
-        }
-        installRefusalWarnings.add(context);
-        logExtension({
-            subsystem: "project-trust",
-            level: "warn",
-            message: `install/materialization blocked: ${context}`,
-            metadata: { context, trustState },
-        });
-    }
-    return false;
-}
-/**
- * False only when the host actively denied trust. Gates LSP server child
- * process spawns.
- */
-export function isLspSpawnAllowedByTrust() {
-    return trustState !== "untrusted";
-}
-/** Human/log-readable reason, or undefined when nothing is being blocked. */
-export function projectTrustDenialReason() {
-    return trustState === "untrusted"
-        ? "project is not trusted (host isProjectTrusted() === false)"
-        : undefined;
-}

package/dist/clients/python-environment.js

@@ -1,217 +0,0 @@
-import { access, readFile } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { extractTomlTableSection, hasTomlTable, parseTomlStringArray, } from "./cargo-manifest.js";
-import { isAtOrAboveHomeDir, matchesWorkspaceMemberPattern, toPosix, UV_WORKSPACE_EXCLUDE_DIALECT, UV_WORKSPACE_MEMBERS_DIALECT, walkUpDirs, } from "./path-utils.js";
-const UV_WORKSPACE_TABLE = "tool\\.uv\\.workspace";
-/**
- * Resolve the uv workspace root using the same discovery shape as uv:
- * start at the nearest pyproject, then continue upward for an explicit
- * `[tool.uv.workspace]` declaration. A nearest pyproject without that table
- * is an implicit single-project workspace.
- *
- * The walk stops AT `homeDir` (`isAtOrAboveHomeDir`, the shared ceiling
- * primitive from #625) so a `pyproject.toml` sitting in `/tmp`, `/home`, or
- * `$HOME` itself cannot supply the environment for every project beneath it.
- * `homeDir` is injected rather than read from `os.homedir()` inside the walk
- * for the same reason every sibling walker takes it (#2536, #2544 F2): the
- * ceiling is otherwise untestable.
- */
-async function findUvWorkspace(startDir, homeDir) {
-    const resolvedStart = path.resolve(startDir);
-    let nearestProject;
-    for (const dir of walkUpDirs(startDir)) {
-        if (isAtOrAboveHomeDir(dir, homeDir))
-            break;
-        let content;
-        try {
-            content = await readFile(path.join(dir, "pyproject.toml"), "utf8");
-        }
-        catch {
-            continue;
-        }
-        if (!nearestProject)
-            nearestProject = dir;
-        if (hasTomlTable(content, UV_WORKSPACE_TABLE)) {
-            const workspaceTable = extractTomlTableSection(content, UV_WORKSPACE_TABLE);
-            return {
-                root: dir,
-                explicit: true,
-                projectRoot: nearestProject,
-                isStartDir: nearestProject === resolvedStart,
-                members: parseTomlStringArray(workspaceTable, "members"),
-                exclude: parseTomlStringArray(workspaceTable, "exclude"),
-            };
-        }
-    }
-    return nearestProject
-        ? {
-            root: nearestProject,
-            explicit: false,
-            projectRoot: nearestProject,
-            isStartDir: nearestProject === resolvedStart,
-            members: [],
-            exclude: [],
-        }
-        : undefined;
-}
-/**
- * Apply uv's explicit-workspace membership rules before inheriting its root
- * environment. The workspace root is always a member; descendants must match
- * a declared member glob and must not match an exclusion glob.
- *
- * The glob dialects are pinned to uv 3c979abda4530fe9bf3d92e9bcf5c5575e3b3126,
- * `crates/uv-workspace/src/workspace.rs`, and live beside the ONE shared
- * workspace-member matcher (#2591) instead of as a minimatch options block
- * here: `UV_WORKSPACE_MEMBERS_DIALECT` for `members`
- * (`is_included_in_workspace` — `MatchOptions { require_literal_separator:
- * true, ..MatchOptions::new() }`) and `UV_WORKSPACE_EXCLUDE_DIALECT` for
- * `exclude` (`WorkspaceExclusions::matches` — `Pattern::matches_path`, i.e.
- * `MatchOptions::new()` defaults, where `require_literal_separator` is FALSE
- * and a `*` therefore crosses `/`). Both normalize the pattern first
- * (`normalize_path`, so a leading `./` is not part of the pattern) and are
- * case-SENSITIVE on every platform with no literal-leading-dot requirement.
- *
- * That `exclude` option set used to be a documented limitation rather than
- * behavior: minimatch cannot express a separator-crossing `*`, so
- * `exclude = ['packages/a*c']` did not exclude `packages/a/b/c`. A dialect
- * object can, so #2591 implements it — the one intentional answer change in
- * that fold.
- */
-function isUvWorkspaceMember(workspace, projectRoot) {
-    // No `projectRoot === workspace.root` shortcut. uv treats the workspace
-    // root as a member of its own workspace, but only in its capacity as a
-    // PROJECT — and a project already gets uv's settings through `isStartDir`,
-    // with its own `<root>/.venv` reached by the ordinary project candidate at
-    // the very same path. Answering "member" on directory equality made every
-    // non-project subdirectory of the workspace root inherit the workspace
-    // `.venv`, `exclude` included, because equality was tested before the
-    // walk result was consulted (review round 3, S2). The relative-path guard
-    // below returns false for the root itself, which is the intended answer.
-    const relative = toPosix(path.relative(workspace.root, projectRoot));
-    if (relative.length === 0 ||
-        relative === ".." ||
-        relative.startsWith("../") ||
-        path.isAbsolute(relative)) {
-        return false;
-    }
-    const matches = (dialect) => (pattern) => matchesWorkspaceMemberPattern(pattern, relative, dialect);
-    return (!workspace.exclude.some(matches(UV_WORKSPACE_EXCLUDE_DIALECT)) &&
-        workspace.members.some(matches(UV_WORKSPACE_MEMBERS_DIALECT)));
-}
-/**
- * Resolve the interpreter and executable directory for the project's Python
- * environment without activating it or invoking a package manager.
- */
-export async function detectPythonEnvironment(projectRoot, homeDir = os.homedir()) {
-    // `path.resolve` once at the seam entry so `isStartDir` below compares like
-    // with like: `walkUpDirs` resolves its input, a caller's argument need not
-    // be normalized.
-    const root = path.resolve(projectRoot);
-    const uvWorkspace = await findUvWorkspace(root, homeDir);
-    // `UV_PROJECT_ENVIRONMENT` and the workspace `.venv` are uv PROJECT
-    // settings. uv applies them to a directory only when that directory IS the
-    // project — a `pyproject.toml` merely sitting somewhere ABOVE it makes it a
-    // subdirectory of a project, not a project, and nothing below a project
-    // root inherits from it (the F3 decision, applied consistently). Exporting
-    // `UV_PROJECT_ENVIRONMENT` process-wide is uv's own documented CI/Docker
-    // recipe, so a gate on "a pyproject exists at or above root" lets one
-    // image-level variable capture every subdirectory on the box that happens
-    // to sit under some Python project.
-    const isProjectRoot = uvWorkspace?.isStartDir === true;
-    // A declared, non-excluded member of an EXPLICIT workspace is itself a
-    // project root, so this is a strict refinement of `isProjectRoot`: it adds
-    // the workspace `.venv` candidate and re-anchors a relative
-    // `UV_PROJECT_ENVIRONMENT` at the workspace root.
-    const memberWorkspaceRoot = isProjectRoot &&
-        uvWorkspace.explicit &&
-        isUvWorkspaceMember(uvWorkspace, root)
-        ? uvWorkspace.root
-        : undefined;
-    const uvEnvironmentRoot = isProjectRoot
-        ? (memberWorkspaceRoot ?? uvWorkspace.projectRoot)
-        : undefined;
-    const uvProjectEnvironment = process.env.UV_PROJECT_ENVIRONMENT;
-    // PEP 723 `uv run --script` environments are cache-keyed by script content;
-    // without a stable project marker or explicit path, they remain undiscoverable.
-    const candidates = [
-        ...(uvEnvironmentRoot !== undefined && uvProjectEnvironment
-            ? [
-                {
-                    // `path.resolve` leaves an absolute value untouched and
-                    // anchors a relative one at the project's workspace root.
-                    root: path.resolve(uvEnvironmentRoot, uvProjectEnvironment),
-                    source: "uv-project-environment",
-                },
-            ]
-            : []),
-        ...(memberWorkspaceRoot !== undefined
-            ? [
-                {
-                    root: path.join(memberWorkspaceRoot, ".venv"),
-                    source: "uv-workspace",
-                },
-            ]
-            : []),
-        { root: process.env.VIRTUAL_ENV, source: "virtual-env" },
-        { root: process.env.CONDA_PREFIX, source: "conda" },
-        { root: path.join(root, ".venv"), source: "project-dot-venv" },
-        { root: path.join(root, "venv"), source: "project-venv" },
-    ];
-    for (const candidate of candidates) {
-        if (!candidate.root)
-            continue;
-        const binDir = path.join(candidate.root, process.platform === "win32" ? "Scripts" : "bin");
-        const pythonPath = path.join(binDir, process.platform === "win32" ? "python.exe" : "python");
-        try {
-            await access(pythonPath);
-            return {
-                root: candidate.root,
-                binDir,
-                pythonPath,
-                source: candidate.source,
-            };
-        }
-        catch {
-            // The marker can outlive its environment. Continue to the next candidate.
-        }
-    }
-    return undefined;
-}
-/** Preserve the existing interpreter-only API used by LSP initialization. */
-export async function detectPythonVenv(projectRoot) {
-    return (await detectPythonEnvironment(projectRoot))?.pythonPath;
-}
-/**
- * Build a child-only environment for Python tools. The host process remains
- * unchanged, so another project can resolve a different environment.
- */
-export function augmentPythonEnvironment(baseEnvironment, environment) {
-    if (!environment)
-        return baseEnvironment;
-    const inheritedPath = baseEnvironment.PATH ?? baseEnvironment.Path ?? baseEnvironment.path ?? "";
-    const augmentedPath = inheritedPath
-        ? `${environment.binDir}${path.delimiter}${inheritedPath}`
-        : environment.binDir;
-    const childEnvironment = {
-        ...baseEnvironment,
-        PATH: augmentedPath,
-        VIRTUAL_ENV: environment.root,
-    };
-    if (process.platform === "win32")
-        childEnvironment.Path = augmentedPath;
-    return childEnvironment;
-}
-/** Return explicit project-environment candidates before a bare PATH fallback. */
-export function pythonEnvironmentToolCandidates(environment, command) {
-    if (!environment)
-        return [];
-    if (process.platform !== "win32") {
-        return [path.join(environment.binDir, command)];
-    }
-    return [
-        path.join(environment.binDir, `${command}.exe`),
-        path.join(environment.binDir, `${command}.cmd`),
-        path.join(environment.binDir, command),
-    ];
-}