pi-tool-discipline 0.1.11 → 0.1.13

package/extensions/search.ts

@@ -11,6 +11,13 @@ const MAX_FILES = 2000;
 const MAX_VISITED = 5000; // total entries touched, bounds slow/odd trees
 const MAX_FILE_BYTES = 1024 * 1024; // content search skips files larger than 1 MiB
 const MAX_OUTPUT_BYTES = 50 * 1024;
+const MAX_RESULTS = 1000; // hard ceiling for matches/results
+
+/** Normalize maxResults: non-finite/non-number falls back to the default. */
+function clampLimit(raw: number | undefined): number {
+	const n = typeof raw === "number" && Number.isFinite(raw) ? Math.floor(raw) : 100;
+	return Math.min(Math.max(1, n), MAX_RESULTS);
+}
 const TRUNCATE_MARKER = "\n[output truncated]";
 const CAPPED_MARKER = "\n[search capped — traversal stopped early]";
 
@@ -35,6 +42,14 @@ interface WalkState {
 	rootError?: string;
 }
 
+/** Injectable fs ops so tests can deterministically trigger fs errors. */
+interface WalkFsOps {
+	readdir: (dir: string) => Promise<string[]>;
+	lstat: (p: string) => Promise<{ isSymbolicLink(): boolean; isDirectory(): boolean; isFile(): boolean }>;
+}
+
+const defaultFs: WalkFsOps = { readdir, lstat };
+
 /**
  * Collect regular files under dir (depth-limited, symlink-safe, bounded,
  * abort-aware). Only isFile() entries are collected — FIFOs, devices, sockets
@@ -43,7 +58,14 @@ interface WalkState {
  * A failure to read the REQUESTED ROOT (depth 0) is recorded in rootError;
  * nested unreadable entries are skipped.
  */
-async function walk(dir: string, out: string[], state: WalkState, signal?: AbortSignal, depth = 0): Promise<void> {
+export async function walk(
+	dir: string,
+	out: string[],
+	state: WalkState,
+	signal?: AbortSignal,
+	depth = 0,
+	fsOps: WalkFsOps = defaultFs,
+): Promise<void> {
 	throwIfAborted(signal);
 	if (depth > 12 || state.visited >= MAX_VISITED) {
 		state.capped = true;
@@ -51,7 +73,7 @@ async function walk(dir: string, out: string[], state: WalkState, signal?: Abort
 	}
 	let entries: string[];
 	try {
-		entries = await readdir(dir);
+		entries = await fsOps.readdir(dir);
 	} catch (error: any) {
 		throwIfAborted(signal); // cancellation wins over the fs error
 		if (depth === 0) state.rootError = error?.message ?? String(error);
@@ -67,11 +89,11 @@ async function walk(dir: string, out: string[], state: WalkState, signal?: Abort
 		const p = join(dir, entry);
 		state.visited++;
 		try {
-			const lst = await lstat(p);
+			const lst = await fsOps.lstat(p);
 			throwIfAborted(signal);
 			if (lst.isSymbolicLink()) continue; // never follow symlinks
 			if (lst.isDirectory()) {
-				await walk(p, out, state, signal, depth + 1);
+				await walk(p, out, state, signal, depth + 1, fsOps);
 				throwIfAborted(signal);
 			} else if (lst.isFile()) out.push(p); // regular files only
 		} catch (error: any) {
@@ -91,9 +113,12 @@ function truncate(text: string, maxBytes = MAX_OUTPUT_BYTES, extraMarkerBytes =
 	if (buf.length + extraMarkerBytes <= maxBytes) return text;
 	const budget = maxBytes - Buffer.byteLength(TRUNCATE_MARKER) - extraMarkerBytes;
 	if (budget <= 0) return TRUNCATE_MARKER.trim();
-	const cut = buf.subarray(0, budget).toString("utf8");
+	let cut = buf.subarray(0, budget).toString("utf8");
+	// A multibyte char split by subarray becomes U+FFFD (3 bytes) which can
+	// exceed the budget — trim back to a valid encoded prefix.
+	while (Buffer.byteLength(cut, "utf8") > budget) cut = cut.slice(0, -1);
 	const lastNewline = cut.lastIndexOf("\n");
-	if (lastNewline <= 0) return TRUNCATE_MARKER.trim(); // nothing complete fits
+	if (lastNewline <= 0) return `${cut}${TRUNCATE_MARKER}`; // no complete line: bounded prefix + marker
 	return `${cut.slice(0, lastNewline)}\n${TRUNCATE_MARKER}`;
 }
 
@@ -125,12 +150,14 @@ export async function grepFiles(opts: {
 }): Promise<string> {
 	throwIfAborted(opts.signal);
 	const root = await resolveRoot(opts.cwd, opts.path, opts.signal);
-	if (!root) return `Error: search path not found: ${resolve(opts.cwd, opts.path || ".")}`;
+	if (!root) return truncate(`Error: search path not found: ${resolve(opts.cwd, opts.path || ".")}`);
 	const pattern = opts.caseSensitive ? opts.pattern : opts.pattern.toLowerCase();
-	const limit = opts.maxResults ?? 100;
+	// Hard internal ceiling: bounds memory/work even for direct API calls that
+	// bypass schema validation (NaN/Infinity included).
+	const limit = clampLimit(opts.maxResults);
 	const { files, state } = await walkFiles(root, opts.signal);
 	throwIfAborted(opts.signal);
-	if (state.rootError) return `Error: cannot read search root ${root}: ${state.rootError}`;
+	if (state.rootError) return truncate(`Error: cannot read search root ${root}: ${state.rootError}`);
 	const matches: FileMatch[] = [];
 	for (const file of files) {
 		throwIfAborted(opts.signal);
@@ -179,11 +206,12 @@ export async function findFiles(opts: {
 }): Promise<string> {
 	throwIfAborted(opts.signal);
 	const root = await resolveRoot(opts.cwd, opts.path, opts.signal);
-	if (!root) return `Error: search path not found: ${resolve(opts.cwd, opts.path || ".")}`;
+	if (!root) return truncate(`Error: search path not found: ${resolve(opts.cwd, opts.path || ".")}`);
 	const { files, state } = await walkFiles(root, opts.signal);
 	throwIfAborted(opts.signal);
-	if (state.rootError) return `Error: cannot read search root ${root}: ${state.rootError}`;
+	if (state.rootError) return truncate(`Error: cannot read search root ${root}: ${state.rootError}`);
 	const needle = opts.pattern?.toLowerCase();
+	const resultLimit = clampLimit(opts.maxResults);
 	// Match against the RELATIVE path so a pattern matching an ancestor
 	// directory does not hit every file, and rendered output stays relative.
 	const rel: string[] = [];
@@ -195,7 +223,7 @@ export async function findFiles(opts: {
 	for (const r of rel) {
 		throwIfAborted(opts.signal);
 		if (!needle || r.toLowerCase().includes(needle)) hits.push(r);
-		if (hits.length >= (opts.maxResults ?? 100)) break;
+		if (hits.length >= resultLimit) break;
 	}
 	if (hits.length === 0) return state.capped ? `No matching files found${CAPPED_MARKER}` : "No matching files found";
 	let out = truncate(hits.join("\n"), MAX_OUTPUT_BYTES, state.capped ? Buffer.byteLength(CAPPED_MARKER) : 0);
@@ -206,7 +234,7 @@ export async function findFiles(opts: {
 export async function listDir(opts: { path?: string; cwd: string; signal?: AbortSignal }): Promise<string> {
 	throwIfAborted(opts.signal);
 	const root = await resolveRoot(opts.cwd, opts.path, opts.signal);
-	if (!root) return `Error: directory not found: ${resolve(opts.cwd, opts.path || ".")}`;
+	if (!root) return truncate(`Error: directory not found: ${resolve(opts.cwd, opts.path || ".")}`);
 	try {
 		const entries = await readdir(root);
 		throwIfAborted(opts.signal);
@@ -214,7 +242,7 @@ export async function listDir(opts: { path?: string; cwd: string; signal?: Abort
 		return truncate(entries.join("\n"));
 	} catch (error: any) {
 		throwIfAborted(opts.signal);
-		return `Error listing ${root}: ${error.message}`;
+		return truncate(`Error listing ${root}: ${error.message}`);
 	}
 }
 
@@ -222,13 +250,13 @@ export const grepSchema = Type.Object({
 	pattern: Type.String({ description: "Text to search for in file contents" }),
 	path: Type.Optional(Type.String({ description: "Directory to search (defaults to cwd)" })),
 	caseSensitive: Type.Optional(Type.Boolean({ description: "Case-sensitive match (default false)" })),
-	maxResults: Type.Optional(Type.Integer({ minimum: 1, description: "Max matches (default 100)" })),
+	maxResults: Type.Optional(Type.Integer({ minimum: 1, maximum: MAX_RESULTS, description: "Max matches (default 100)" })),
 });
 
 export const findSchema = Type.Object({
 	pattern: Type.Optional(Type.String({ description: "Substring to match in file path or name (empty lists all)" })),
 	path: Type.Optional(Type.String({ description: "Directory to search (defaults to cwd)" })),
-	maxResults: Type.Optional(Type.Integer({ minimum: 1, description: "Max results (default 100)" })),
+	maxResults: Type.Optional(Type.Integer({ minimum: 1, maximum: MAX_RESULTS, description: "Max results (default 100)" })),
 });
 
 export const lsSchema = Type.Object({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-tool-discipline",
-  "version": "0.1.11",
+  "version": "0.1.13",
   "description": "pi extension: enforce ffgrep/fffind-first search discipline and neutralize the default bash file-operation guideline",
   "type": "module",
   "license": "MIT",