@aefree/pi-plastic 0.5.5 → 0.5.7

package/CHANGELOG.md

@@ -7,6 +7,18 @@ and this project follows semantic versioning for public package releases.
 
 ## Unreleased
 
+## [0.5.7] - 2026-09-14
+
+### Fixed
+
+- Bind automatic pending-file diff bases to the owning workspace or Xlink repository/server before materialization, preventing colliding revision IDs from another repository from producing plausible but unrelated diffs. Unresolved ownership is reported as unavailable.
+
+## [0.5.6] - 2026-08-27
+
+### Fixed
+
+- Warn once per interactive Pi runtime when a configured `PI_PLASTIC_PATCH_EXECUTABLE` cannot launch or Windows lacks its required patch backend setting. Warnings redact configured paths; `plastic_patch` retains its existing tool-time validation.
+
 ## [0.5.5] - 2026-08-14
 
 ### Changed

package/README.md

@@ -73,7 +73,7 @@ Pi 0.82 and newer use canonical `sourceInfo` provenance to identify this package
 The Bash guards run only in Pi processes that actually load this package. A project-local install does not protect a delegated child process whose working directory resolves different project settings. Install `pi-plastic` at user scope (the default `pi install`, without `-l`) when subagents and sessions in arbitrary workspaces must inherit the guards. Restart existing Pi processes after installation or source changes.
 
 - `plastic_branchCreate` supports an explicit parent branch independent of the loaded workspace branch, defaults relative names to the current branch when no parent is supplied, and rejects top-level paths unless `allowRootBranch=true` is explicit.
-- `plastic_diff` remains a disabled alias by design. Use `plastic_status` for changed-path listing; do not diff as routine post-edit validation or checkin preflight. When change-boundary evidence is needed, use `plastic_diffFile` for one exact file, `plastic_workspaceDiff` with selected paths or explicit `allPending=true`, or `plastic_diffRevisions` for an explicit historical pair. Diff responses use small defaults and caller-controlled `maxChars` bounds. Historical and workspace bytes are copied to ASCII-safe package-owned paths before the backend runs, while normalized headers retain the logical Unicode labels.
+- `plastic_diff` remains a disabled alias by design. Use `plastic_status` for changed-path listing; do not diff as routine post-edit validation or checkin preflight. When change-boundary evidence is needed, use `plastic_diffFile` for one exact file, `plastic_workspaceDiff` with selected paths or explicit `allPending=true`, or `plastic_diffRevisions` for an explicit historical pair. Diff responses use small defaults and caller-controlled `maxChars` bounds. Automatic pending-file bases bind each status revision ID to its owning workspace or Xlink repository/server, including mixed-Xlink reviews. If ownership cannot be resolved, that comparison is reported unavailable rather than retrieving a bare revision from the caller repository. Historical and workspace bytes are copied to ASCII-safe package-owned paths before the backend runs, while normalized headers retain the logical Unicode labels.
 - `plastic_status(machineReadable=true, format="json")` returns parsed `items`, aggregate `summary`, and `itemCount` (`total`, `returned`, `omitted`) rather than requiring agents to parse Plastic rows. It returns at most 100 items by default; set `maxItems` (up to 500) when more are intentional. `includeRaw=true` adds the original unbounded Plastic output for diagnostics, so omit it for normal agent use to conserve context tokens.
 - Preflight is not routine confirmation. Use it for ambiguous or broad mutation scope, moved/deleted path rewriting, compound operations, or explicit preview requests; otherwise rely on exact targets and the tools' runtime guards.
 - `plastic_patch` generates review patches with `cm patch`, including `clean` and `integration` filters for branch review workflows. It does not expose patch apply. Unqualified `br:/...` selectors are qualified only with the current workspace selector's exact repository; otherwise pass `br:/<branch>@<repository>@<server>`.
@@ -108,13 +108,13 @@ pi install npm:@aefree/pi-plastic
 Install a pinned GitHub release over HTTPS:
 
 ```bash
-pi install git:github.com/aefreedman/pi-plastic@v0.5.4
+pi install git:github.com/aefreedman/pi-plastic@v0.5.7
 ```
 
 Equivalent SSH install:
 
 ```bash
-pi install git:git@github.com/aefreedman/pi-plastic@v0.5.4
+pi install git:git@github.com/aefreedman/pi-plastic@v0.5.7
 ```
 
 To intentionally track the moving default branch instead of a release tag:
@@ -143,7 +143,7 @@ Project-local installation protects only Pi processes that load those project se
 - Pi 0.82.0 or newer; the current development and eval baseline is Pi 0.83
 - Plastic SCM / Unity Version Control CLI (`cm`) available on `PATH`, or `PI_PLASTIC_CM_EXECUTABLE` set to its full executable path
 - A GNU/POSIX-compatible text `diff` available on `PATH`, or `PI_PLASTIC_DIFF_EXECUTABLE` set to its full executable path (including paths containing spaces), for text-only diff tools. Pi invokes that resolved executable as-is and does not discover Git Bash paths automatically. On macOS, bare `diff` is PATH-dependent: it may be GNU Diffutils (often installed as `diff` ahead of system paths) or Apple’s BSD `/usr/bin/diff`; the package does not substitute one for the other. Configure the intended text executable explicitly when that distinction matters.
-- Patch generation has a separate executable policy: `toolPath` is the one-call highest-priority override, followed by `PI_PLASTIC_PATCH_EXECUTABLE`. On Windows, set one to a verified patch-capable non-GUI executable such as Git's `diff.exe`; the package deliberately does not reuse `PI_PLASTIC_DIFF_EXECUTABLE`/GnuWin32 as a patch default. macOS validation with Plastic 11 found that Apple BSD `/usr/bin/diff` supports text-only diffs but rejects the `--binary` argument supplied by `cm patch`; configure a verified GNU Diffutils-compatible executable explicitly for `plastic_patch`. The non-Windows fallback to `PI_PLASTIC_DIFF_EXECUTABLE` or bare `diff` remains only for environments whose resolved executable satisfies that patch contract.
+- Patch generation has a separate executable policy: `toolPath` is the one-call highest-priority override, followed by `PI_PLASTIC_PATCH_EXECUTABLE`. On Windows, set one to a verified patch-capable non-GUI executable such as Git's `diff.exe`; the package deliberately does not reuse `PI_PLASTIC_DIFF_EXECUTABLE`/GnuWin32 as a patch default. macOS validation with Plastic 11 found that Apple BSD `/usr/bin/diff` supports text-only diffs but rejects the `--binary` argument supplied by `cm patch`; configure a verified GNU Diffutils-compatible executable explicitly for `plastic_patch`. The non-Windows fallback to `PI_PLASTIC_DIFF_EXECUTABLE` or bare `diff` remains only for environments whose resolved executable satisfies that patch contract. In an interactive Pi session, an invalid configured patch override or missing Windows patch setting produces one package capability warning per Pi runtime; the warning omits configured paths, and `plastic_patch` retains its tool-time validation.
 - A configured Plastic workspace for workspace-scoped operations. Text diffs require an ASCII-safe temporary directory; if the configured backend cannot accept Unicode paths, set `TEMP` and `TMP` to a writable ASCII-only location.
 - `pi-file-discovery` is an optional independently loaded integration. When its `discover_candidate_files` tool is active, it receives the advisory Plastic ignore/cloak filter through the shared global capability protocol; when absent, `pi-plastic` loads without file-discovery filtering. The tarball does not embed linked sibling workspaces or `node_modules` paths.
 

package/index.ts

@@ -656,6 +656,28 @@ function metadataDescription(node: CoreSchemaNode): string {
   return node.metadata?.description ?? "Allowed values.";
 }
 
+type CapabilityDiagnosticContext = {
+  hasUI?: boolean;
+  ui?: { notify?: (message: string, level: "warning") => void };
+};
+
+type PatchCapabilityWarningGetter = () => Promise<string | undefined>;
+
+export const __plasticCapabilityDiagnosticInternals = {
+  createPatchCapabilityWarningNotifier(getWarning: PatchCapabilityWarningGetter = () => core.getPatchBackendCapabilityWarning()) {
+    let emitted = false;
+    return async (ctx: CapabilityDiagnosticContext): Promise<void> => {
+      if (emitted || !ctx.hasUI || typeof ctx.ui?.notify !== "function") return;
+      const warning = await getWarning();
+      if (!warning) return;
+      emitted = true;
+      ctx.ui.notify(warning, "warning");
+    };
+  },
+};
+
+const notifyPatchCapabilityWarning = __plasticCapabilityDiagnosticInternals.createPatchCapabilityWarningNotifier();
+
 function buildParameters(args: Record<string, unknown> | undefined): TSchema {
   if (!args || Object.keys(args).length === 0) {
     return EMPTY_PARAMETERS;
@@ -770,7 +792,8 @@ export default function plasticTools(pi: ExtensionAPI) {
     },
   });
 
-  pi.on("session_start", (_event, ctx) => {
+  pi.on("session_start", async (_event, ctx) => {
+    await notifyPatchCapabilityWarning(ctx as CapabilityDiagnosticContext);
     const ownership = getEffectivePlasticToolOwnership(pi.getAllTools(), EXTENSION_SOURCE_PATH);
     const active = pi.getActiveTools();
     const mode = getPlasticToolLoadingMode();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aefree/pi-plastic",
-  "version": "0.5.5",
+  "version": "0.5.7",
   "type": "module",
   "engines": {
     "node": ">=22.19.0"
@@ -18,8 +18,7 @@
     "skills/",
     "CHANGELOG.md",
     "LICENSE",
-    "README.md",
-    "SECURITY.md"
+    "README.md"
   ],
   "pi": {
     "extensions": [
@@ -34,7 +33,7 @@
     ]
   },
   "scripts": {
-    "test": "npx --yes tsx tests/plastic-tool-validation.ts && npx --yes tsx tests/plastic-status-machine-readable.test.ts && npx --yes tsx tests/plastic-checkin-path-resolution.ts && npx --yes tsx tests/plastic-diff-workflow.test.ts && npx --yes tsx tests/plastic-workspace-diff.test.ts && npx --yes tsx tests/plastic-process-lifecycle.test.ts && npx --yes tsx tests/plastic-patch-command.test.ts && npx --yes tsx tests/plastic-extension-registration.test.ts && npx --yes tsx tests/plastic-dynamic-tool-loading.test.ts && npx --yes tsx tests/plastic-tool-rendering.test.ts && npx --yes tsx tests/plastic-branch-query.test.ts && npx --yes tsx tests/plastic-workspace.test.ts && npx --yes tsx tests/plastic-mutation-execution.test.ts && npx --yes tsx tests/file-discovery-filter.test.ts && npx --yes tsx tests/file-discovery-filter-registration.test.ts && npx --yes tsx tests/packed-copy-owner-conflict.test.ts && npx --yes tsx tests/plastic-branch-status.test.ts && npx --yes tsx tests/plastic-constrained-sampling.test.ts && npx --yes tsx tests/bash-cm-diff-guard-validation.ts",
+    "test": "npx --yes tsx tests/plastic-tool-validation.ts && npx --yes tsx tests/plastic-status-machine-readable.test.ts && npx --yes tsx tests/plastic-checkin-path-resolution.ts && npx --yes tsx tests/plastic-diff-workflow.test.ts && npx --yes tsx tests/plastic-workspace-diff.test.ts && npx --yes tsx tests/plastic-process-lifecycle.test.ts && npx --yes tsx tests/plastic-patch-command.test.ts && npx --yes tsx tests/plastic-capability-diagnostics.test.ts && npx --yes tsx tests/plastic-extension-registration.test.ts && npx --yes tsx tests/plastic-dynamic-tool-loading.test.ts && npx --yes tsx tests/plastic-tool-rendering.test.ts && npx --yes tsx tests/plastic-branch-query.test.ts && npx --yes tsx tests/plastic-workspace.test.ts && npx --yes tsx tests/plastic-mutation-execution.test.ts && npx --yes tsx tests/file-discovery-filter.test.ts && npx --yes tsx tests/file-discovery-filter-registration.test.ts && npx --yes tsx tests/packed-copy-owner-conflict.test.ts && npx --yes tsx tests/plastic-branch-status.test.ts && npx --yes tsx tests/plastic-constrained-sampling.test.ts && npx --yes tsx tests/bash-cm-diff-guard-validation.ts",
     "test:live": "npx --yes tsx tests/plastic-live-smoke.test.ts",
     "test:live:branch-create": "npx --yes tsx tests/plastic-branch-create-live.test.ts",
     "eval:tool-loading": "npx --yes tsx evals/tool-loading/run-eval.ts"

package/skills/using-plastic/SKILL.md

@@ -22,7 +22,7 @@ Plastic merges are workspace- and branch-oriented, not Git fast-forwards: the me
 
 `plastic_workspaceDiff` requires selected paths or explicit `allPending=true`, runs status once, has small default file/per-file/combined-output bounds, and returns per-file outcomes without aborting when one file is unavailable. Selected private paths are included; whole-workspace private review additionally requires `includePrivate=true`. Keep `maxChars` small unless more output is intentional. Text-diff selection and patch-backend selection are distinct: text tools use `PI_PLASTIC_DIFF_EXECUTABLE` or bare PATH `diff`. On macOS, bare `diff` can resolve either to GNU Diffutils or Apple’s BSD `/usr/bin/diff`; Pi uses the resolved executable and does not auto-select `gdiff`.
 
-Use `plastic_patch` for review patch generation with `clean` and `integration` filters; it is generation-only and does not apply patches. `toolPath` is its highest-priority one-call patch-backend override, followed by `PI_PLASTIC_PATCH_EXECUTABLE`. On Windows, configure one to a verified patch-capable non-GUI executable such as Git's `diff.exe`: patch generation deliberately does not reuse `PI_PLASTIC_DIFF_EXECUTABLE`/GnuWin32. On macOS with Plastic 11, Apple BSD `/usr/bin/diff` works for text-only `plastic_diffFile` but rejects the `--binary` argument used by `cm patch`; set the patch-specific policy to a verified GNU Diffutils-compatible non-GUI executable. The non-Windows fallback to the text setting or bare `diff` is only valid when that executable accepts the local Plastic patch arguments. Unqualified `br:/...` patch selectors are qualified only from the current workspace's exact selector repository; otherwise pass `br:/<branch>@<repository>@<server>`. For a large patch, pass an intentional new `output` path: the package stages and atomically publishes it, never overwriting an existing path. Do not use `cm cat --raw`: it is unsupported for this workflow. Typed retrieval owns cleanup; the low-level byte-preserving fallback is `cm cat --file` only when a typed tool cannot represent the case. Plastic/server output may represent moves as moves or delete/add records, so inspect generated patches rather than assuming a move-aware encoding.
+Use `plastic_patch` for review patch generation with `clean` and `integration` filters; it is generation-only and does not apply patches. `toolPath` is its highest-priority one-call patch-backend override, followed by `PI_PLASTIC_PATCH_EXECUTABLE`. On Windows, configure one to a verified patch-capable non-GUI executable such as Git's `diff.exe`: patch generation deliberately does not reuse `PI_PLASTIC_DIFF_EXECUTABLE`/GnuWin32. On macOS with Plastic 11, Apple BSD `/usr/bin/diff` works for text-only `plastic_diffFile` but rejects the `--binary` argument used by `cm patch`; set the patch-specific policy to a verified GNU Diffutils-compatible non-GUI executable. The non-Windows fallback to the text setting or bare `diff` is only valid when that executable accepts the local Plastic patch arguments. Interactive Pi sessions issue one path-redacted package capability warning per runtime for an invalid configured patch override or missing Windows setting; fix `PI_PLASTIC_PATCH_EXECUTABLE` and retry, while headless sessions retain `plastic_patch` tool-time validation. Unqualified `br:/...` patch selectors are qualified only from the current workspace's exact selector repository; otherwise pass `br:/<branch>@<repository>@<server>`. For a large patch, pass an intentional new `output` path: the package stages and atomically publishes it, never overwriting an existing path. Do not use `cm cat --raw`: it is unsupported for this workflow. Typed retrieval owns cleanup; the low-level byte-preserving fallback is `cm cat --file` only when a typed tool cannot represent the case. Plastic/server output may represent moves as moves or delete/add records, so inspect generated patches rather than assuming a move-aware encoding.
 
 Prefer runtime `plastic_*` tools first. Keep `cm` shell commands as manual fallback.
 

package/src/plastic-core.ts

@@ -32,6 +32,7 @@ const getCmExecutable = (): string => resolveExecutable(process.env, "PI_PLASTIC
 // Keep the executable name configurable rather than assuming a .exe suffix or package-manager path.
 const getDiffExecutable = (): string => resolveExecutable(process.env, "PI_PLASTIC_DIFF_EXECUTABLE", "diff");
 const PLASTIC_PATCH_EXECUTABLE_ENV = "PI_PLASTIC_PATCH_EXECUTABLE";
+type PatchExecutableProbe = (command: string) => Promise<boolean>;
 // Plastic's server/backend determines whether a moved item is encoded as a
 // move or as delete/add records. Do not claim either without a live fixture.
 const PATCH_MOVE_REPRESENTATION = "backend-determined" as const;
@@ -312,6 +313,7 @@ type PendingItem = {
     kind: PendingItemKind;
     revisionId?: string;
     sourceWorkspacePath?: string;
+    baseRepository?: string;
 };
 
 type PendingItemSummary = {
@@ -1228,6 +1230,49 @@ const assertNonBlankPatchValue = (name: keyof PatchCommandArgs, value: string |
     }
 };
 
+const probePatchExecutable = async (command: string): Promise<boolean> =>
+{
+    try
+    {
+        // This establishes only that the configured executable can launch.
+        // `cm patch` remains the authoritative verifier for its --binary contract.
+        const result = await spawnAndCollect(command, ["--version"], process.cwd(), undefined, AbortSignal.timeout(3000), {
+            abortKillDelayMs: 100,
+            outputLimitChars: 1024,
+        });
+        return !result.aborted;
+    }
+    catch
+    {
+        return false;
+    }
+};
+
+export const getPatchBackendCapabilityWarning = async (
+    environment: ExecutableEnvironment = process.env,
+    platform: NodeJS.Platform = process.platform,
+    probe: PatchExecutableProbe = probePatchExecutable,
+): Promise<string | undefined> =>
+{
+    const configuredPatchExecutable = environment[PLASTIC_PATCH_EXECUTABLE_ENV]?.trim();
+    if (configuredPatchExecutable)
+    {
+        if (await probe(configuredPatchExecutable))
+        {
+            return undefined;
+        }
+
+        return "Pi Plastic capability warning: the configured PI_PLASTIC_PATCH_EXECUTABLE could not be launched. Set it to a verified patch-capable non-GUI diff executable, or remove the override to use this platform's documented fallback. The configured path is not shown for privacy.";
+    }
+
+    if (platform === "win32")
+    {
+        return "Pi Plastic capability warning: plastic_patch requires PI_PLASTIC_PATCH_EXECUTABLE on Windows. Set it to a verified patch-capable non-GUI diff executable (for example Git's diff.exe). PI_PLASTIC_DIFF_EXECUTABLE is only for text diffs.";
+    }
+
+    return undefined;
+};
+
 const resolvePatchToolPath = (
     toolPath?: string,
     environment: ExecutableEnvironment = process.env,
@@ -1491,6 +1536,7 @@ export const __plasticProcessInternals = {
 export const __plasticPatchInternals = {
     buildPatchCommandArgs,
     resolvePatchToolPath,
+    getPatchBackendCapabilityWarning,
     qualifyPatchBranchSpec,
     resolvePatchBranchSpecs,
     createPatchOutputStaging,
@@ -1698,6 +1744,153 @@ const materializeRevision = async (revision: string, destination: string, workdi
     }
 };
 
+type PendingBaseIdentityResolver = {
+    resolve: (item: PendingItem) => Promise<string>;
+};
+
+type RepositoryIdentity = {
+    repository: string;
+    server: string;
+};
+
+const parseRepositoryIdentity = (selector: string | undefined): RepositoryIdentity | null =>
+{
+    if (!selector || /[\u0000-\u001f\u007f]/.test(selector))
+    {
+        return null;
+    }
+    // Repository names cannot contain @; cloud server names can (for example,
+    // an organization-qualified cloud endpoint), so split only at the first @.
+    const separator = selector.indexOf("@");
+    if (separator <= 0 || separator === selector.length - 1)
+    {
+        return null;
+    }
+    return { repository: selector.slice(0, separator), server: selector.slice(separator + 1) };
+};
+
+const parseRepositorySelector = (output: string): RepositoryIdentity | null =>
+{
+    const match = output.match(/^\s*repository\s+(?:"([^"]+)"|(\S+))\s*$/mi);
+    return parseRepositoryIdentity(match?.[1] ?? match?.[2]);
+};
+
+const parseXlinkRepositorySelector = (output: string): RepositoryIdentity | null =>
+{
+    // `cm xlink --show` reports wxlink:<serverpath>@<loaded-revision>@<repository>@<server>.
+    const match = output.match(/^.+?\s+-->\s+wxlink:.+?@(?:\d+|cs:\d+)@(.+)\s*$/mi);
+    return parseRepositoryIdentity(match?.[1]?.trim());
+};
+
+const isNotXlinkError = (error: unknown): boolean => /\bis not an xlink\.?\s*$/i.test(error instanceof Error ? error.message.trim() : String(error).trim());
+
+const createPendingBaseIdentityResolver = (cwd: string, workdir?: string): PendingBaseIdentityResolver =>
+{
+    let workspaceRoot: Promise<string> | undefined;
+    const getWorkspaceRoot = (): Promise<string> =>
+    {
+        workspaceRoot ??= discoverPlasticWorkspace(cwd).then((outcome) =>
+        {
+            if (outcome.kind !== "found")
+            {
+                throw new Error(`Plastic cannot determine the workspace root for pending base resolution: ${outcome.kind === "unavailable" ? outcome.reason : "no workspace marker found"}.`);
+            }
+            return toNormalizedAbsolutePath(outcome.value.root, cwd);
+        });
+        return workspaceRoot;
+    };
+    const xlinkLookups = new Map<string, Promise<RepositoryIdentity | null>>();
+    let workspaceRepository: Promise<RepositoryIdentity> | undefined;
+    const getWorkspaceRepository = (): Promise<RepositoryIdentity> =>
+    {
+        workspaceRepository ??= runCmRaw(["showselector"], workdir).then((output) =>
+        {
+            const repository = parseRepositorySelector(output);
+            if (!repository)
+            {
+                throw new Error("Plastic returned no repository/server identity for this workspace.");
+            }
+            return repository;
+        });
+        return workspaceRepository;
+    };
+    const getXlinkRepository = (candidate: string): Promise<RepositoryIdentity | null> =>
+    {
+        const key = toPathComparisonKeyFromAbsolutePath(candidate);
+        let lookup = xlinkLookups.get(key);
+        if (!lookup)
+        {
+            lookup = runCmRaw(["xlink", "--show", candidate], workdir)
+                .then((output) =>
+                {
+                    const repository = parseXlinkRepositorySelector(output);
+                    if (!repository)
+                    {
+                        throw new Error(`Plastic returned malformed Xlink ownership for '${candidate}'.`);
+                    }
+                    return repository;
+                })
+                .catch((error) =>
+                {
+                    if (isNotXlinkError(error))
+                    {
+                        return null;
+                    }
+                    throw error;
+                });
+            xlinkLookups.set(key, lookup);
+        }
+        return lookup;
+    };
+
+    return {
+        async resolve(item)
+        {
+            if (!item.revisionId)
+            {
+                throw new Error(`Plastic status did not provide a base revision ID for '${item.workspacePath}'.`);
+            }
+            const root = await getWorkspaceRoot();
+            const ownershipPath = item.kind === "moved" && item.sourceWorkspacePath
+                ? toNormalizedAbsolutePath(item.sourceWorkspacePath, cwd)
+                : item.normalizedPath;
+            if (!isWithinPathScope(toPathComparisonKeyFromAbsolutePath(ownershipPath), toPathComparisonKeyFromAbsolutePath(root)))
+            {
+                throw new Error(`Plastic cannot resolve an owning repository for '${item.workspacePath}' outside the requested workspace.`);
+            }
+            let candidate = dirname(ownershipPath);
+            while (isWithinPathScope(toPathComparisonKeyFromAbsolutePath(candidate), toPathComparisonKeyFromAbsolutePath(root)))
+            {
+                // A missing ancestor can be a removed Xlink mount. Status does not
+                // retain ownership, so parent-repository fallback would be unsafe.
+                if ((item.kind === "deleted" || item.kind === "moved") && !(await fs.stat(candidate).catch(() => null)))
+                {
+                    throw new Error(`Plastic cannot resolve the owning repository for '${item.workspacePath}' because an ownership ancestor is missing.`);
+                }
+                const repository = await getXlinkRepository(candidate);
+                if (repository)
+                {
+                    item.baseRepository = `${repository.repository}@${repository.server}`;
+                    return `revid:${item.revisionId}@rep:${repository.repository}@repserver:${repository.server}`;
+                }
+                if (candidate === root)
+                {
+                    break;
+                }
+                const parent = dirname(candidate);
+                if (parent === candidate)
+                {
+                    break;
+                }
+                candidate = parent;
+            }
+            const repository = await getWorkspaceRepository();
+            item.baseRepository = `${repository.repository}@${repository.server}`;
+            return `revid:${item.revisionId}@rep:${repository.repository}@repserver:${repository.server}`;
+        },
+    };
+};
+
 const normalizeDiffResponseMaxChars = (value: unknown): number =>
 {
     if (typeof value !== "number" || !Number.isFinite(value))
@@ -3127,6 +3320,7 @@ type WorkspacePendingDiff = {
 const diffPendingWorkspaceFile = async (
     args: { path: string; workdir?: string },
     pendingItem?: PendingItem,
+    baseIdentityResolver?: PendingBaseIdentityResolver,
 ): Promise<WorkspacePendingDiff> =>
 {
     const cwd = args.workdir ?? process.cwd();
@@ -3150,11 +3344,19 @@ const diffPendingWorkspaceFile = async (
             ? `${revisionPath} (empty before private/new file)`
             : workspaceBase.resolved.includes("#") ? workspaceBase.resolved.replace("#", "@") : `${revisionPath} (Plastic base)`;
     const rightLabel = isDeleted ? `${displayPath} (empty after delete)` : `${displayPath} (workspace)`;
-    const materializeSpec = pendingItem?.revisionId ? `revid:${pendingItem.revisionId}` : workspaceBase.resolved;
     if (isDeleted && !pendingItem?.revisionId)
     {
         throw new Error(`Plastic status identified '${args.path}' as deleted but did not provide its base revision ID.`);
     }
+    let materializeSpec = workspaceBase.resolved;
+    if (pendingItem?.revisionId && !isAdded && !isPrivate)
+    {
+        if (!baseIdentityResolver)
+        {
+            throw new Error(`Plastic cannot resolve the owning repository for '${args.path}'.`);
+        }
+        materializeSpec = await baseIdentityResolver.resolve(pendingItem);
+    }
 
     const tempDir = await createAsciiTempDirectory("plastic-core-");
     const basePath = join(tempDir, `base${safeTempExtension(workspacePath)}`);
@@ -3259,14 +3461,14 @@ export const diffFile = tool({
         const workspacePath = toNormalizedAbsolutePath(args.path, cwd);
         const pendingItems = await getMachineReadablePendingItems(args.workdir);
         const pendingItem = pendingItems.find((item) => item.comparisonKey === toPathComparisonKeyFromAbsolutePath(workspacePath));
-        const compared = await diffPendingWorkspaceFile(args, pendingItem);
+        const compared = await diffPendingWorkspaceFile(args, pendingItem, createPendingBaseIdentityResolver(cwd, args.workdir));
         return formatTextDiff(
             "diffFile",
             args.format,
             compared.comparisonKind,
             compared.result,
             args.workdir,
-            { pendingKind: compared.pendingKind, isNew: compared.pendingKind === "private" || compared.pendingKind === "added", statusRevisionId: pendingItem?.revisionId },
+            { pendingKind: compared.pendingKind, isNew: compared.pendingKind === "private" || compared.pendingKind === "added", statusRevisionId: pendingItem?.revisionId, baseRepositoryResolved: Boolean(pendingItem?.baseRepository) },
             args.maxChars,
         );
     },
@@ -3445,6 +3647,7 @@ export const workspaceDiff = tool({
         const skippedByLimit = Math.max(0, candidates.length - maxFiles);
         candidates = candidates.slice(0, maxFiles);
 
+        const baseIdentityResolver = createPendingBaseIdentityResolver(cwd, args.workdir);
         const outcomes: Array<Record<string, unknown>> = [];
         const textSections: string[] = [];
         let totalOutputChars = 0;
@@ -3468,13 +3671,13 @@ export const workspaceDiff = tool({
             }
             try
             {
-                const compared = await diffPendingWorkspaceFile({ path, workdir: args.workdir }, item);
+                const compared = await diffPendingWorkspaceFile({ path, workdir: args.workdir }, item, baseIdentityResolver);
                 const remaining = Math.max(0, WORKSPACE_DIFF_CONTENT_MAX_CHARS - totalOutputChars);
                 const perFile = boundWorkspaceDiffResult(compared.result, maxChars);
                 const bounded = boundWorkspaceDiffResult(perFile, remaining);
                 const status = bounded.binary ? (bounded.changed ? "binary-different" : "unchanged") : (bounded.changed ? "changed" : (compared.comparisonKind === "workspace-added" ? "added-empty" : "unchanged"));
                 const diffOutput = bounded.changed && !bounded.binary ? bounded.output : undefined;
-                outcomes.push({ path: displayPath, kind: item.kind, comparisonKind: compared.comparisonKind, status, changed: bounded.changed, binary: bounded.binary, truncated: bounded.truncated, totalChars: bounded.totalChars, ...(diffOutput ? { diff: diffOutput } : {}) });
+                outcomes.push({ path: displayPath, kind: item.kind, comparisonKind: compared.comparisonKind, status, changed: bounded.changed, binary: bounded.binary, truncated: bounded.truncated, totalChars: bounded.totalChars, baseRepositoryResolved: Boolean(item.baseRepository), ...(diffOutput ? { diff: diffOutput } : {}) });
                 const body = bounded.binary ? (bounded.changed ? "Binary content differs; a text diff is unavailable." : "No differences.") : (bounded.changed ? bounded.output : (status === "added-empty" ? "Added file is empty; no text diff hunks." : "No differences."));
                 const section = `### ${displayPath} (${item.kind})\n${body}`;
                 textSections.push(section);

package/SECURITY.md

@@ -1,31 +0,0 @@
-# Security Policy
-
-## Supported versions
-
-Security fixes are provided for the latest tagged release. Upgrade to the newest release before reporting an issue that may already be fixed.
-
-## Reporting a vulnerability
-
-Do not open a public issue for a suspected vulnerability, credential exposure, or unsafe command-execution path.
-
-Use GitHub's private vulnerability reporting for this repository:
-
-<https://github.com/aefreedman/pi-plastic/security/advisories/new>
-
-Include:
-
-- the affected package version or commit;
-- the Pi, Node.js, Git, and Plastic CLI versions;
-- the operating system;
-- reproduction steps and expected versus observed behavior;
-- the affected tool or extension;
-- impact and any known mitigations;
-- whether credentials, repository content, or remote Plastic objects may have been exposed or changed.
-
-Avoid including real credentials or sensitive repository content. Use a disposable Plastic workspace when a reproduction requires mutation.
-
-You should receive an acknowledgement within seven days. Release timing depends on severity, reproducibility, and coordination needs.
-
-## Scope
-
-Security-sensitive areas include command construction, executable-path overrides, workspace/path targeting, destructive Plastic operations, provider payload capture, dynamic tool ownership, and package-install behavior. General support questions and ordinary bugs belong in the public issue tracker.