pi-webdesk 0.1.0

package/dist/packages/pi-bridge/src/resources.js

@@ -0,0 +1,481 @@
+// packages/pi-bridge/src/resources.ts
+import { spawn } from "node:child_process";
+import { readFile, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import {
+  DefaultPackageManager,
+  ProjectTrustStore,
+  SettingsManager,
+  VERSION,
+  getAgentDir,
+  hasTrustRequiringProjectResources,
+  parseFrontmatter
+} from "@earendil-works/pi-coding-agent";
+import { z } from "zod";
+import { PiBridgeError } from "./errors.js";
+var INSPECTION_TIMEOUT_MS = 12e3;
+var MAX_CHILD_OUTPUT_BYTES = 2 * 1024 * 1024;
+var MAX_CHILD_ERROR_BYTES = 64 * 1024;
+var MAX_RESOURCE_METADATA_BYTES = 256 * 1024;
+var MAX_RESOURCES = 500;
+var MAX_PACKAGES = 100;
+var MAX_DIAGNOSTICS = 100;
+var SETTING_DEFINITIONS = [
+  { key: "defaultProvider", label: "Default provider", category: "model", path: ["defaultProvider"], effective: (manager) => manager.getDefaultProvider() },
+  { key: "defaultModel", label: "Default model", category: "model", path: ["defaultModel"], effective: (manager) => manager.getDefaultModel() },
+  { key: "defaultThinkingLevel", label: "Thinking level", category: "model", path: ["defaultThinkingLevel"], effective: (manager) => manager.getDefaultThinkingLevel() },
+  { key: "theme", label: "Pi terminal theme", category: "display", path: ["theme"], effective: (manager) => manager.getThemeSetting() },
+  { key: "steeringMode", label: "Steering delivery", category: "behavior", path: ["steeringMode"], effective: (manager) => manager.getSteeringMode() },
+  { key: "followUpMode", label: "Follow-up delivery", category: "behavior", path: ["followUpMode"], effective: (manager) => manager.getFollowUpMode() },
+  { key: "hideThinkingBlock", label: "Hide thinking blocks", category: "display", path: ["hideThinkingBlock"], effective: (manager) => manager.getHideThinkingBlock() },
+  { key: "showCacheMissNotices", label: "Show cache notices", category: "display", path: ["showCacheMissNotices"], effective: (manager) => manager.getShowCacheMissNotices() },
+  { key: "defaultProjectTrust", label: "Default project trust", category: "privacy", path: ["defaultProjectTrust"], effective: (manager) => manager.getDefaultProjectTrust() },
+  { key: "enableSkillCommands", label: "Skill slash commands", category: "tools", path: ["enableSkillCommands"], effective: (manager) => manager.getEnableSkillCommands() },
+  { key: "defaultTools", label: "Default tools", category: "tools", path: ["defaultTools"], effective: (manager) => manager.getDefaultTools() },
+  { key: "enabledModels", label: "Enabled models", category: "model", path: ["enabledModels"], effective: (manager) => manager.getEnabledModels() },
+  { key: "compaction.enabled", label: "Automatic compaction", category: "behavior", path: ["compaction", "enabled"], effective: (manager) => manager.getCompactionSettings().enabled },
+  { key: "compaction.reserveTokens", label: "Compaction reserve", category: "behavior", path: ["compaction", "reserveTokens"], effective: (manager) => manager.getCompactionSettings().reserveTokens },
+  { key: "compaction.keepRecentTokens", label: "Recent tokens retained", category: "behavior", path: ["compaction", "keepRecentTokens"], effective: (manager) => manager.getCompactionSettings().keepRecentTokens },
+  { key: "retry.enabled", label: "Automatic retries", category: "behavior", path: ["retry", "enabled"], effective: (manager) => manager.getRetrySettings().enabled },
+  { key: "retry.maxRetries", label: "Maximum retries", category: "behavior", path: ["retry", "maxRetries"], effective: (manager) => manager.getRetrySettings().maxRetries },
+  { key: "quietStartup", label: "Quiet startup", category: "display", path: ["quietStartup"], effective: (manager) => manager.getQuietStartup() },
+  { key: "externalEditor", label: "External editor", category: "tools", path: ["externalEditor"], effective: (manager) => manager.getExternalEditorCommand() },
+  { key: "shellPath", label: "Shell", category: "tools", path: ["shellPath"], effective: (manager) => manager.getShellPath() },
+  { key: "terminal.showImages", label: "Terminal images", category: "display", path: ["terminal", "showImages"], effective: (manager) => manager.getShowImages() },
+  { key: "markdown.mermaid", label: "Mermaid rendering", category: "display", path: ["markdown", "mermaid"], effective: (manager) => manager.getMermaidRenderingMode() },
+  { key: "enableAnalytics", label: "Pi analytics", category: "privacy", path: ["enableAnalytics"], effective: (manager) => manager.getEnableAnalytics() },
+  { key: "enableInstallTelemetry", label: "Pi install telemetry", category: "privacy", path: ["enableInstallTelemetry"], effective: (manager) => manager.getEnableInstallTelemetry() }
+];
+var diagnosticSchema = z.object({
+  severity: z.enum(["warning", "error"]),
+  message: z.string(),
+  path: z.string().nullable()
+}).strict();
+var inspectedResourceSchema = z.object({
+  kind: z.enum(["extension", "skill", "prompt", "theme"]),
+  name: z.string(),
+  description: z.string().nullable(),
+  path: z.string(),
+  scope: z.enum(["user", "project", "temporary"]),
+  origin: z.enum(["package", "top-level"]),
+  source: z.string(),
+  enabled: z.boolean(),
+  disabledReason: z.enum(["filtered", "project-untrusted"]).nullable()
+}).strict();
+var inspectedPackageSchema = z.object({
+  source: z.string(),
+  scope: z.enum(["user", "project"]),
+  filtered: z.boolean(),
+  installed: z.boolean(),
+  installedPath: z.string().nullable(),
+  enabled: z.boolean()
+}).strict();
+var inspectedSettingSchema = z.object({
+  key: z.string(),
+  label: z.string(),
+  category: z.enum(["model", "behavior", "display", "tools", "privacy"]),
+  globalValue: z.string().nullable(),
+  projectValue: z.string().nullable(),
+  effectiveValue: z.string(),
+  effectiveScope: z.enum(["default", "user", "project"])
+}).strict();
+var piConfigurationInspectionSchema = z.object({
+  piVersion: z.string(),
+  cwd: z.string(),
+  agentDir: z.string(),
+  settingsPaths: z.object({ global: z.string(), project: z.string(), trust: z.string() }).strict(),
+  trust: z.object({
+    required: z.boolean(),
+    effective: z.boolean(),
+    savedDecision: z.boolean().nullable(),
+    savedAtPath: z.string().nullable(),
+    defaultPolicy: z.enum(["ask", "always", "never"])
+  }).strict(),
+  packages: z.array(inspectedPackageSchema),
+  resources: z.array(inspectedResourceSchema),
+  settings: z.array(inspectedSettingSchema),
+  diagnostics: z.array(diagnosticSchema),
+  omitted: z.object({ packages: z.number().int().nonnegative(), resources: z.number().int().nonnegative(), diagnostics: z.number().int().nonnegative() }).strict()
+}).strict();
+function rawSetting(settings, keys) {
+  let value = settings;
+  for (const key of keys) {
+    if (typeof value !== "object" || value === null || !(key in value)) return void 0;
+    value = value[key];
+  }
+  return value;
+}
+function formatSetting(value) {
+  if (value === void 0) return null;
+  if (value === null) return "None";
+  if (typeof value === "string") return value === "" ? "Empty" : value;
+  if (typeof value === "number" || typeof value === "boolean") return String(value);
+  if (Array.isArray(value)) {
+    return value.length === 0 ? "None" : value.map((item) => String(item)).join(", ");
+  }
+  try {
+    return JSON.stringify(value);
+  } catch {
+    return "Configured";
+  }
+}
+function resourceLabel(kind, resourcePath) {
+  const name = path.basename(resourcePath);
+  if (kind === "skill" && name === "SKILL.md") return path.basename(path.dirname(resourcePath));
+  return name.replace(/\.(?:ts|js|mjs|cjs|md|json)$/iu, "") || kind;
+}
+function isWithin(root, candidate) {
+  const relative = path.relative(root, candidate);
+  return relative === "" || !relative.startsWith(`..${path.sep}`) && relative !== "..";
+}
+async function readMetadataFile(filePath, allowedRoot) {
+  let verifiedPath = filePath;
+  if (allowedRoot !== void 0) {
+    const [canonicalRoot, canonicalFile] = await Promise.all([
+      realpath(allowedRoot),
+      realpath(filePath)
+    ]);
+    if (!isWithin(canonicalRoot, canonicalFile)) {
+      throw new Error("project resource metadata resolves outside the task worktree");
+    }
+    verifiedPath = canonicalFile;
+  }
+  const details = await stat(verifiedPath);
+  if (!details.isFile()) throw new Error("resource metadata path is not a file");
+  if (details.size > MAX_RESOURCE_METADATA_BYTES) {
+    throw new Error("resource metadata exceeds the read-only inspection limit");
+  }
+  return readFile(verifiedPath, "utf8");
+}
+async function resourceMetadata(kind, resourcePath, allowedRoot) {
+  if (kind === "extension") return {};
+  if (kind === "theme") {
+    const parsed2 = JSON.parse(await readMetadataFile(resourcePath, allowedRoot));
+    if (typeof parsed2 === "object" && parsed2 !== null) {
+      const name2 = parsed2["name"];
+      return typeof name2 === "string" ? { name: name2 } : {};
+    }
+    return {};
+  }
+  const metadataPath = kind === "skill" && path.basename(resourcePath) !== "SKILL.md" ? path.join(resourcePath, "SKILL.md") : resourcePath;
+  const parsed = parseFrontmatter(
+    await readMetadataFile(metadataPath, allowedRoot)
+  );
+  const name = parsed.frontmatter["name"];
+  const description = parsed.frontmatter["description"];
+  return {
+    ...typeof name === "string" && name.trim() !== "" ? { name } : {},
+    ...typeof description === "string" ? { description } : {}
+  };
+}
+function disabledState(resource, projectTrusted) {
+  if (resource.metadata.scope === "project" && !projectTrusted) {
+    return { enabled: false, disabledReason: "project-untrusted" };
+  }
+  if (!resource.enabled) return { enabled: false, disabledReason: "filtered" };
+  return { enabled: true, disabledReason: null };
+}
+function addDiagnostic(diagnostics, seen, diagnostic) {
+  const identity = `${diagnostic.severity}\0${diagnostic.path ?? ""}\0${diagnostic.message}`;
+  if (seen.has(identity)) return;
+  seen.add(identity);
+  diagnostics.push(diagnostic);
+}
+function settingsDiagnostics(manager, diagnostics, seen) {
+  for (const issue of manager.drainErrors()) {
+    addDiagnostic(diagnostics, seen, {
+      severity: "error",
+      message: `Pi could not read ${issue.scope} settings: ${issue.error.message}`,
+      path: null
+    });
+  }
+}
+function packageEntries(settings, scope) {
+  return (settings.packages ?? []).map((entry) => ({
+    source: typeof entry === "string" ? entry : entry.source,
+    scope,
+    filtered: typeof entry === "object"
+  }));
+}
+function bounded(items, maximum) {
+  return { items: items.slice(0, maximum), omitted: Math.max(0, items.length - maximum) };
+}
+async function inspectPiConfigurationInProcess(options) {
+  if (!path.isAbsolute(options.cwd)) {
+    throw new PiBridgeError("PI_INVALID_CONFIGURATION", "Pi inspection cwd must be absolute");
+  }
+  const cwd = path.normalize(options.cwd);
+  const agentDir = path.normalize(options.agentDir ?? getAgentDir());
+  const diagnostics = [];
+  const diagnosticSeen = /* @__PURE__ */ new Set();
+  const globalManager = SettingsManager.create(cwd, agentDir, { projectTrusted: false });
+  const inspectionManager = SettingsManager.create(cwd, agentDir, { projectTrusted: true });
+  const globalSettings = globalManager.getGlobalSettings();
+  const projectSettings = inspectionManager.getProjectSettings();
+  const defaultPolicy = globalManager.getDefaultProjectTrust();
+  const trustRequired = hasTrustRequiringProjectResources(cwd);
+  const savedTrust = new ProjectTrustStore(agentDir).getEntry(cwd);
+  const projectTrusted = !trustRequired || savedTrust?.decision === true || savedTrust === null && defaultPolicy === "always";
+  const effectiveManager = SettingsManager.create(cwd, agentDir, { projectTrusted });
+  settingsDiagnostics(globalManager, diagnostics, diagnosticSeen);
+  settingsDiagnostics(inspectionManager, diagnostics, diagnosticSeen);
+  settingsDiagnostics(effectiveManager, diagnostics, diagnosticSeen);
+  if (trustRequired && savedTrust === null && defaultPolicy === "ask") {
+    addDiagnostic(diagnostics, diagnosticSeen, {
+      severity: "warning",
+      message: "Project-local Pi resources are disabled in RPC mode until the project has a saved trust decision.",
+      path: path.join(cwd, ".pi")
+    });
+  }
+  const packageManager = new DefaultPackageManager({
+    cwd,
+    agentDir,
+    // Until trust is effective, Pi's manager receives no project settings at
+    // all. This prevents an untrusted repository from making discovery probe
+    // arbitrary configured package/resource paths merely to label them.
+    settingsManager: effectiveManager
+  });
+  const rawPackages = [
+    ...packageEntries(globalSettings, "user"),
+    ...packageEntries(projectSettings, "project")
+  ];
+  const packages = rawPackages.map((entry) => {
+    if (entry.scope === "project" && !projectTrusted) {
+      return {
+        ...entry,
+        installed: false,
+        installedPath: null,
+        enabled: false
+      };
+    }
+    try {
+      const installedPath = packageManager.getInstalledPath(entry.source, entry.scope);
+      return {
+        ...entry,
+        installed: installedPath !== void 0,
+        installedPath: installedPath ?? null,
+        enabled: (entry.scope !== "project" || projectTrusted) && installedPath !== void 0
+      };
+    } catch (error) {
+      addDiagnostic(diagnostics, diagnosticSeen, {
+        severity: "error",
+        message: `Pi could not inspect package ${entry.source}: ${error instanceof Error ? error.message : "invalid package source"}`,
+        path: null
+      });
+      return { ...entry, installed: false, installedPath: null, enabled: false };
+    }
+  });
+  const resources = [];
+  try {
+    const resolved = await packageManager.resolve(async () => "skip");
+    const groups = [
+      ["extension", resolved.extensions],
+      ["skill", resolved.skills],
+      ["prompt", resolved.prompts],
+      ["theme", resolved.themes]
+    ];
+    for (const [kind, entries] of groups) {
+      for (const entry of entries) {
+        let metadata = {};
+        if (entry.metadata.scope !== "project" || projectTrusted) {
+          try {
+            metadata = await resourceMetadata(
+              kind,
+              entry.path,
+              entry.metadata.scope === "project" ? cwd : void 0
+            );
+          } catch (error) {
+            addDiagnostic(diagnostics, diagnosticSeen, {
+              severity: "warning",
+              message: `${kind} metadata could not be read: ${error instanceof Error ? error.message : "unknown error"}`,
+              path: entry.path
+            });
+          }
+        }
+        resources.push({
+          kind,
+          name: metadata.name?.trim() || resourceLabel(kind, entry.path),
+          description: metadata.description?.trim() || null,
+          path: entry.path,
+          scope: entry.metadata.scope,
+          origin: entry.metadata.origin,
+          source: entry.metadata.source || "local",
+          ...disabledState(entry, projectTrusted)
+        });
+      }
+    }
+  } catch (error) {
+    addDiagnostic(diagnostics, diagnosticSeen, {
+      severity: "error",
+      message: `Pi resource discovery failed: ${error instanceof Error ? error.message : "unknown error"}`,
+      path: null
+    });
+  }
+  const settings = SETTING_DEFINITIONS.map((definition) => {
+    const globalRaw = rawSetting(globalSettings, definition.path);
+    const projectRaw = rawSetting(projectSettings, definition.path);
+    const effectiveScope = projectTrusted && projectRaw !== void 0 ? "project" : globalRaw !== void 0 ? "user" : "default";
+    return {
+      key: definition.key,
+      label: definition.label,
+      category: definition.category,
+      globalValue: formatSetting(globalRaw),
+      projectValue: formatSetting(projectRaw),
+      effectiveValue: formatSetting(definition.effective(effectiveManager)) ?? "Not set",
+      effectiveScope
+    };
+  });
+  const boundedPackages = bounded(packages, MAX_PACKAGES);
+  const boundedResources = bounded(resources, MAX_RESOURCES);
+  const boundedDiagnostics = bounded(diagnostics, MAX_DIAGNOSTICS);
+  return {
+    piVersion: VERSION,
+    cwd,
+    agentDir,
+    settingsPaths: {
+      global: path.join(agentDir, "settings.json"),
+      project: path.join(cwd, ".pi", "settings.json"),
+      trust: path.join(agentDir, "trust.json")
+    },
+    trust: {
+      required: trustRequired,
+      effective: projectTrusted,
+      savedDecision: savedTrust?.decision ?? null,
+      savedAtPath: savedTrust?.path ?? null,
+      defaultPolicy
+    },
+    packages: boundedPackages.items,
+    resources: boundedResources.items,
+    settings,
+    diagnostics: boundedDiagnostics.items,
+    omitted: {
+      packages: boundedPackages.omitted,
+      resources: boundedResources.omitted,
+      diagnostics: boundedDiagnostics.omitted
+    }
+  };
+}
+function killInspector(child) {
+  try {
+    child.kill("SIGKILL");
+  } catch {
+  }
+}
+function createPiConfigurationInspector(options = {}) {
+  const timeoutMs = options.timeoutMs ?? INSPECTION_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4) {
+    throw new PiBridgeError("PI_INVALID_CONFIGURATION", "Pi inspection timeout is invalid");
+  }
+  const spawnProcess = options.spawnProcess ?? spawn;
+  const childPath = options.childPath ?? fileURLToPath(new URL("./resources-child.mjs", import.meta.url));
+  return {
+    inspect(cwd) {
+      if (!path.isAbsolute(cwd)) {
+        return Promise.reject(
+          new PiBridgeError("PI_INVALID_CONFIGURATION", "Pi inspection cwd must be absolute")
+        );
+      }
+      return new Promise((resolve, reject) => {
+        const child = spawnProcess(process.execPath, [childPath], {
+          cwd,
+          env: { ...options.env ?? process.env, PI_OFFLINE: "1" },
+          stdio: ["pipe", "pipe", "pipe"]
+        });
+        let stdout = Buffer.alloc(0);
+        let stderrBytes = 0;
+        let settled = false;
+        const finish = (operation) => {
+          if (settled) return;
+          settled = true;
+          clearTimeout(timer);
+          operation();
+        };
+        const timer = setTimeout(() => {
+          killInspector(child);
+          finish(
+            () => reject(
+              new PiBridgeError("PI_REQUEST_TIMEOUT", "Pi configuration inspection timed out")
+            )
+          );
+        }, timeoutMs);
+        timer.unref?.();
+        child.stdout.on("data", (chunk) => {
+          if (settled) return;
+          if (stdout.length + chunk.length > MAX_CHILD_OUTPUT_BYTES) {
+            killInspector(child);
+            finish(
+              () => reject(
+                new PiBridgeError(
+                  "PI_PROTOCOL_VIOLATION",
+                  "Pi configuration inspection exceeded its output bound"
+                )
+              )
+            );
+            return;
+          }
+          stdout = Buffer.concat([stdout, chunk]);
+        });
+        child.stderr.on("data", (chunk) => {
+          stderrBytes += chunk.length;
+          if (stderrBytes > MAX_CHILD_ERROR_BYTES) killInspector(child);
+        });
+        child.on("error", (error) => {
+          finish(
+            () => reject(
+              new PiBridgeError("PI_SPAWN_FAILED", "Pi configuration inspector could not start", {
+                cause: error
+              })
+            )
+          );
+        });
+        child.on("close", (code, signal) => {
+          finish(() => {
+            if (code !== 0 || signal !== null) {
+              reject(
+                new PiBridgeError(
+                  "PI_RUNTIME_EXITED",
+                  "Pi configuration inspection did not complete",
+                  { details: { code, signal } }
+                )
+              );
+              return;
+            }
+            let decoded;
+            try {
+              decoded = JSON.parse(stdout.toString("utf8"));
+            } catch (error) {
+              reject(
+                new PiBridgeError(
+                  "PI_PROTOCOL_VIOLATION",
+                  "Pi configuration inspector returned invalid JSON",
+                  { cause: error }
+                )
+              );
+              return;
+            }
+            const parsed = piConfigurationInspectionSchema.safeParse(decoded);
+            if (!parsed.success) {
+              reject(
+                new PiBridgeError(
+                  "PI_PROTOCOL_VIOLATION",
+                  "Pi configuration inspector returned incompatible data",
+                  { cause: parsed.error }
+                )
+              );
+              return;
+            }
+            resolve(parsed.data);
+          });
+        });
+        child.stdin.on("error", () => {
+        });
+        child.stdin.end(JSON.stringify({ cwd: path.normalize(cwd) }));
+      });
+    }
+  };
+}
+export {
+  createPiConfigurationInspector,
+  inspectPiConfigurationInProcess
+};