@aefree/pi-plastic 0.5.6 → 0.5.8

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project follows semantic versioning for public package releases.
 
 ## Unreleased
 
+## [0.5.8] - 2026-09-15
+
+### Fixed
+
+- Resolve pending-diff workspace containment and Xlink ownership by filesystem identity when a workspace is accessed through a real filesystem alias, while retaining the caller's lexical path for Plastic commands and displayed paths. Missing deleted or moved ownership ancestors still fail closed.
+- Retry only npm registry E404 availability checks for a bounded period after trusted publishing; a mismatched, malformed, or unauthorized release identity still fails immediately.
+
+## [0.5.7] - 2026-09-14
+
+### Fixed
+
+- Bind automatic pending-file diff bases to the owning workspace or Xlink repository/server before materialization, preventing colliding revision IDs from another repository from producing plausible but unrelated diffs. Unresolved ownership is reported as unavailable.
+
 ## [0.5.6] - 2026-08-27
 
 ### Fixed

package/README.md

@@ -73,8 +73,9 @@ Pi 0.82 and newer use canonical `sourceInfo` provenance to identify this package
 The Bash guards run only in Pi processes that actually load this package. A project-local install does not protect a delegated child process whose working directory resolves different project settings. Install `pi-plastic` at user scope (the default `pi install`, without `-l`) when subagents and sessions in arbitrary workspaces must inherit the guards. Restart existing Pi processes after installation or source changes.
 
 - `plastic_branchCreate` supports an explicit parent branch independent of the loaded workspace branch, defaults relative names to the current branch when no parent is supplied, and rejects top-level paths unless `allowRootBranch=true` is explicit.
-- `plastic_diff` remains a disabled alias by design. Use `plastic_status` for changed-path listing; do not diff as routine post-edit validation or checkin preflight. When change-boundary evidence is needed, use `plastic_diffFile` for one exact file, `plastic_workspaceDiff` with selected paths or explicit `allPending=true`, or `plastic_diffRevisions` for an explicit historical pair. Diff responses use small defaults and caller-controlled `maxChars` bounds. Historical and workspace bytes are copied to ASCII-safe package-owned paths before the backend runs, while normalized headers retain the logical Unicode labels.
+- `plastic_diff` remains a disabled alias by design. Use `plastic_status` for changed-path listing; do not diff as routine post-edit validation or checkin preflight. When change-boundary evidence is needed, use `plastic_diffFile` for one exact file, `plastic_workspaceDiff` with selected paths or explicit `allPending=true`, or `plastic_diffRevisions` for an explicit historical pair. Diff responses use small defaults and caller-controlled `maxChars` bounds. Automatic pending-file bases bind each status revision ID to its owning workspace or Xlink repository/server, including mixed-Xlink reviews. If ownership cannot be resolved, that comparison is reported unavailable rather than retrieving a bare revision from the caller repository. Historical and workspace bytes are copied to ASCII-safe package-owned paths before the backend runs, while normalized headers retain the logical Unicode labels.
 - `plastic_status(machineReadable=true, format="json")` returns parsed `items`, aggregate `summary`, and `itemCount` (`total`, `returned`, `omitted`) rather than requiring agents to parse Plastic rows. It returns at most 100 items by default; set `maxItems` (up to 500) when more are intentional. `includeRaw=true` adds the original unbounded Plastic output for diagnostics, so omit it for normal agent use to conserve context tokens.
+- Pending-diff ownership containment uses filesystem identity, so a workspace reached through a symlink, junction, or platform filesystem alias still resolves its workspace and nested Xlink bases safely. Plastic commands and returned labels retain the caller's original lexical path; missing deleted or moved ownership ancestors remain unavailable rather than falling back to a parent repository.
 - Preflight is not routine confirmation. Use it for ambiguous or broad mutation scope, moved/deleted path rewriting, compound operations, or explicit preview requests; otherwise rely on exact targets and the tools' runtime guards.
 - `plastic_patch` generates review patches with `cm patch`, including `clean` and `integration` filters for branch review workflows. It does not expose patch apply. Unqualified `br:/...` selectors are qualified only with the current workspace selector's exact repository; otherwise pass `br:/<branch>@<repository>@<server>`.
 - Bash safety rails block `cm diff` and unsafe interactive `cm merge --merge` usage.
@@ -108,13 +109,13 @@ pi install npm:@aefree/pi-plastic
 Install a pinned GitHub release over HTTPS:
 
 ```bash
-pi install git:github.com/aefreedman/pi-plastic@v0.5.4
+pi install git:github.com/aefreedman/pi-plastic@v0.5.7
 ```
 
 Equivalent SSH install:
 
 ```bash
-pi install git:git@github.com/aefreedman/pi-plastic@v0.5.4
+pi install git:git@github.com/aefreedman/pi-plastic@v0.5.7
 ```
 
 To intentionally track the moving default branch instead of a release tag:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aefree/pi-plastic",
-  "version": "0.5.6",
+  "version": "0.5.8",
   "type": "module",
   "engines": {
     "node": ">=22.19.0"

package/src/plastic-core.ts

@@ -313,6 +313,7 @@ type PendingItem = {
     kind: PendingItemKind;
     revisionId?: string;
     sourceWorkspacePath?: string;
+    baseRepository?: string;
 };
 
 type PendingItemSummary = {
@@ -405,6 +406,37 @@ const findCanonicalExistingAncestor = (absolutePath: string): string | null =>
     }
 };
 
+const toFilesystemIdentityPath = async (absolutePath: string): Promise<string> =>
+{
+    let candidate = absolutePath;
+    const missingSegments: string[] = [];
+    while (true)
+    {
+        try
+        {
+            const canonicalAncestor = (await fs.realpath(candidate)).replace(/\\/g, "/");
+            return missingSegments.reduce((identityPath, segment) => join(identityPath, segment), canonicalAncestor).replace(/\\/g, "/");
+        }
+        catch (error)
+        {
+            const code = (error as NodeJS.ErrnoException).code;
+            if (code !== "ENOENT" && code !== "ENOTDIR")
+            {
+                throw error;
+            }
+
+            const parent = dirname(candidate);
+            if (parent === candidate)
+            {
+                throw error;
+            }
+
+            missingSegments.unshift(basename(candidate));
+            candidate = parent;
+        }
+    }
+};
+
 const toggleFirstAsciiLetterCase = (value: string): string | null =>
 {
     const index = value.search(/[A-Za-z]/);
@@ -1743,6 +1775,162 @@ const materializeRevision = async (revision: string, destination: string, workdi
     }
 };
 
+type PendingBaseIdentityResolver = {
+    resolve: (item: PendingItem) => Promise<string>;
+};
+
+type RepositoryIdentity = {
+    repository: string;
+    server: string;
+};
+
+const parseRepositoryIdentity = (selector: string | undefined): RepositoryIdentity | null =>
+{
+    if (!selector || /[\u0000-\u001f\u007f]/.test(selector))
+    {
+        return null;
+    }
+    // Repository names cannot contain @; cloud server names can (for example,
+    // an organization-qualified cloud endpoint), so split only at the first @.
+    const separator = selector.indexOf("@");
+    if (separator <= 0 || separator === selector.length - 1)
+    {
+        return null;
+    }
+    return { repository: selector.slice(0, separator), server: selector.slice(separator + 1) };
+};
+
+const parseRepositorySelector = (output: string): RepositoryIdentity | null =>
+{
+    const match = output.match(/^\s*repository\s+(?:"([^"]+)"|(\S+))\s*$/mi);
+    return parseRepositoryIdentity(match?.[1] ?? match?.[2]);
+};
+
+const parseXlinkRepositorySelector = (output: string): RepositoryIdentity | null =>
+{
+    // `cm xlink --show` reports wxlink:<serverpath>@<loaded-revision>@<repository>@<server>.
+    const match = output.match(/^.+?\s+-->\s+wxlink:.+?@(?:\d+|cs:\d+)@(.+)\s*$/mi);
+    return parseRepositoryIdentity(match?.[1]?.trim());
+};
+
+const isNotXlinkError = (error: unknown): boolean => /\bis not an xlink\.?\s*$/i.test(error instanceof Error ? error.message.trim() : String(error).trim());
+
+const createPendingBaseIdentityResolver = (cwd: string, workdir?: string): PendingBaseIdentityResolver =>
+{
+    let workspaceRoot: Promise<string> | undefined;
+    const getWorkspaceRoot = (): Promise<string> =>
+    {
+        workspaceRoot ??= discoverPlasticWorkspace(cwd).then((outcome) =>
+        {
+            if (outcome.kind !== "found")
+            {
+                throw new Error(`Plastic cannot determine the workspace root for pending base resolution: ${outcome.kind === "unavailable" ? outcome.reason : "no workspace marker found"}.`);
+            }
+            return toNormalizedAbsolutePath(outcome.value.root, cwd);
+        });
+        return workspaceRoot;
+    };
+    const xlinkLookups = new Map<string, Promise<RepositoryIdentity | null>>();
+    let workspaceRepository: Promise<RepositoryIdentity> | undefined;
+    const getWorkspaceRepository = (): Promise<RepositoryIdentity> =>
+    {
+        workspaceRepository ??= runCmRaw(["showselector"], workdir).then((output) =>
+        {
+            const repository = parseRepositorySelector(output);
+            if (!repository)
+            {
+                throw new Error("Plastic returned no repository/server identity for this workspace.");
+            }
+            return repository;
+        });
+        return workspaceRepository;
+    };
+    const getXlinkRepository = async (candidate: string): Promise<RepositoryIdentity | null> =>
+    {
+        // Use the physical identity for cache keys, but keep candidate lexical for cm.
+        const key = toPathComparisonKeyFromAbsolutePath(await toFilesystemIdentityPath(candidate));
+        let lookup = xlinkLookups.get(key);
+        if (!lookup)
+        {
+            lookup = runCmRaw(["xlink", "--show", candidate], workdir)
+                .then((output) =>
+                {
+                    const repository = parseXlinkRepositorySelector(output);
+                    if (!repository)
+                    {
+                        throw new Error(`Plastic returned malformed Xlink ownership for '${candidate}'.`);
+                    }
+                    return repository;
+                })
+                .catch((error) =>
+                {
+                    if (isNotXlinkError(error))
+                    {
+                        return null;
+                    }
+                    throw error;
+                });
+            xlinkLookups.set(key, lookup);
+        }
+        return lookup;
+    };
+
+    return {
+        async resolve(item)
+        {
+            if (!item.revisionId)
+            {
+                throw new Error(`Plastic status did not provide a base revision ID for '${item.workspacePath}'.`);
+            }
+            const root = await getWorkspaceRoot();
+            const rootIdentity = await toFilesystemIdentityPath(root);
+            const ownershipPath = item.kind === "moved" && item.sourceWorkspacePath
+                ? toNormalizedAbsolutePath(item.sourceWorkspacePath, cwd)
+                : item.normalizedPath;
+            if (!isWithinPathScope(
+                toPathComparisonKeyFromAbsolutePath(await toFilesystemIdentityPath(ownershipPath)),
+                toPathComparisonKeyFromAbsolutePath(rootIdentity),
+            ))
+            {
+                throw new Error(`Plastic cannot resolve an owning repository for '${item.workspacePath}' outside the requested workspace.`);
+            }
+            let candidate = dirname(ownershipPath);
+            while (isWithinPathScope(
+                toPathComparisonKeyFromAbsolutePath(await toFilesystemIdentityPath(candidate)),
+                toPathComparisonKeyFromAbsolutePath(rootIdentity),
+            ))
+            {
+                // A missing ancestor can be a removed Xlink mount. Status does not
+                // retain ownership, so parent-repository fallback would be unsafe.
+                if ((item.kind === "deleted" || item.kind === "moved") && !(await fs.stat(candidate).catch(() => null)))
+                {
+                    throw new Error(`Plastic cannot resolve the owning repository for '${item.workspacePath}' because an ownership ancestor is missing.`);
+                }
+                const repository = await getXlinkRepository(candidate);
+                if (repository)
+                {
+                    item.baseRepository = `${repository.repository}@${repository.server}`;
+                    return `revid:${item.revisionId}@rep:${repository.repository}@repserver:${repository.server}`;
+                }
+                if (toPathComparisonKeyFromAbsolutePath(await toFilesystemIdentityPath(candidate))
+                    === toPathComparisonKeyFromAbsolutePath(rootIdentity))
+                {
+                    break;
+                }
+                const parent = dirname(candidate);
+                if (parent === candidate)
+                {
+                    break;
+                }
+                candidate = parent;
+            }
+            const repository = await getWorkspaceRepository();
+            item.baseRepository = `${repository.repository}@${repository.server}`;
+            return `revid:${item.revisionId}@rep:${repository.repository}@repserver:${repository.server}`;
+        },
+    };
+};
+
 const normalizeDiffResponseMaxChars = (value: unknown): number =>
 {
     if (typeof value !== "number" || !Number.isFinite(value))
@@ -3172,6 +3360,7 @@ type WorkspacePendingDiff = {
 const diffPendingWorkspaceFile = async (
     args: { path: string; workdir?: string },
     pendingItem?: PendingItem,
+    baseIdentityResolver?: PendingBaseIdentityResolver,
 ): Promise<WorkspacePendingDiff> =>
 {
     const cwd = args.workdir ?? process.cwd();
@@ -3195,11 +3384,19 @@ const diffPendingWorkspaceFile = async (
             ? `${revisionPath} (empty before private/new file)`
             : workspaceBase.resolved.includes("#") ? workspaceBase.resolved.replace("#", "@") : `${revisionPath} (Plastic base)`;
     const rightLabel = isDeleted ? `${displayPath} (empty after delete)` : `${displayPath} (workspace)`;
-    const materializeSpec = pendingItem?.revisionId ? `revid:${pendingItem.revisionId}` : workspaceBase.resolved;
     if (isDeleted && !pendingItem?.revisionId)
     {
         throw new Error(`Plastic status identified '${args.path}' as deleted but did not provide its base revision ID.`);
     }
+    let materializeSpec = workspaceBase.resolved;
+    if (pendingItem?.revisionId && !isAdded && !isPrivate)
+    {
+        if (!baseIdentityResolver)
+        {
+            throw new Error(`Plastic cannot resolve the owning repository for '${args.path}'.`);
+        }
+        materializeSpec = await baseIdentityResolver.resolve(pendingItem);
+    }
 
     const tempDir = await createAsciiTempDirectory("plastic-core-");
     const basePath = join(tempDir, `base${safeTempExtension(workspacePath)}`);
@@ -3304,14 +3501,14 @@ export const diffFile = tool({
         const workspacePath = toNormalizedAbsolutePath(args.path, cwd);
         const pendingItems = await getMachineReadablePendingItems(args.workdir);
         const pendingItem = pendingItems.find((item) => item.comparisonKey === toPathComparisonKeyFromAbsolutePath(workspacePath));
-        const compared = await diffPendingWorkspaceFile(args, pendingItem);
+        const compared = await diffPendingWorkspaceFile(args, pendingItem, createPendingBaseIdentityResolver(cwd, args.workdir));
         return formatTextDiff(
             "diffFile",
             args.format,
             compared.comparisonKind,
             compared.result,
             args.workdir,
-            { pendingKind: compared.pendingKind, isNew: compared.pendingKind === "private" || compared.pendingKind === "added", statusRevisionId: pendingItem?.revisionId },
+            { pendingKind: compared.pendingKind, isNew: compared.pendingKind === "private" || compared.pendingKind === "added", statusRevisionId: pendingItem?.revisionId, baseRepositoryResolved: Boolean(pendingItem?.baseRepository) },
             args.maxChars,
         );
     },
@@ -3490,6 +3687,7 @@ export const workspaceDiff = tool({
         const skippedByLimit = Math.max(0, candidates.length - maxFiles);
         candidates = candidates.slice(0, maxFiles);
 
+        const baseIdentityResolver = createPendingBaseIdentityResolver(cwd, args.workdir);
         const outcomes: Array<Record<string, unknown>> = [];
         const textSections: string[] = [];
         let totalOutputChars = 0;
@@ -3513,13 +3711,13 @@ export const workspaceDiff = tool({
             }
             try
             {
-                const compared = await diffPendingWorkspaceFile({ path, workdir: args.workdir }, item);
+                const compared = await diffPendingWorkspaceFile({ path, workdir: args.workdir }, item, baseIdentityResolver);
                 const remaining = Math.max(0, WORKSPACE_DIFF_CONTENT_MAX_CHARS - totalOutputChars);
                 const perFile = boundWorkspaceDiffResult(compared.result, maxChars);
                 const bounded = boundWorkspaceDiffResult(perFile, remaining);
                 const status = bounded.binary ? (bounded.changed ? "binary-different" : "unchanged") : (bounded.changed ? "changed" : (compared.comparisonKind === "workspace-added" ? "added-empty" : "unchanged"));
                 const diffOutput = bounded.changed && !bounded.binary ? bounded.output : undefined;
-                outcomes.push({ path: displayPath, kind: item.kind, comparisonKind: compared.comparisonKind, status, changed: bounded.changed, binary: bounded.binary, truncated: bounded.truncated, totalChars: bounded.totalChars, ...(diffOutput ? { diff: diffOutput } : {}) });
+                outcomes.push({ path: displayPath, kind: item.kind, comparisonKind: compared.comparisonKind, status, changed: bounded.changed, binary: bounded.binary, truncated: bounded.truncated, totalChars: bounded.totalChars, baseRepositoryResolved: Boolean(item.baseRepository), ...(diffOutput ? { diff: diffOutput } : {}) });
                 const body = bounded.binary ? (bounded.changed ? "Binary content differs; a text diff is unavailable." : "No differences.") : (bounded.changed ? bounded.output : (status === "added-empty" ? "Added file is empty; no text diff hunks." : "No differences."));
                 const section = `### ${displayPath} (${item.kind})\n${body}`;
                 textSections.push(section);