@geminixiang/pi-simplify 0.1.0 → 0.1.3

package/CHANGELOG.md

@@ -6,6 +6,26 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-09-07
+
+### Fixed
+
+- Move repository-relative path validation from tool-schema regex lookaheads to runtime checks for better provider compatibility in `/simplify` and `/code-smell`.
+- Reject absolute paths and parent-directory traversal using either forward slashes or backslashes.
+
+## [0.1.2] - 2026-07-26
+
+### Changed
+
+- Move package development and trusted publishing to the `geminixiang/pi-stuff` monorepo.
+- Declare Pi runtime packages as peer dependencies to follow Pi package conventions.
+
+## [0.1.1] - 2026-06-09
+
+### Added
+
+- Add `/simplify previous` mode to review only the last commit (`HEAD~1..HEAD`), with aliases for `previous-commit`, `prev`, and `last-commit`.
+
 ## [0.1.0] - 2026-06-03
 
 ### Added

package/README.md

@@ -58,7 +58,7 @@ Scans specific paths directly.
 /simplify
 ```
 
-Opens a preset selector. Choose uncommitted changes or a folder snapshot.
+Opens a preset selector. Choose uncommitted changes, the previous commit, or a folder snapshot.
 
 Uncommitted mode analyzes all git changes and presents cleanup candidates:
 
@@ -66,6 +66,16 @@ Uncommitted mode analyzes all git changes and presents cleanup candidates:
 - **Confirm** (yellow) - delete after user confirms
 - **Review** (orange) - user should review first
 
+### Simplify Previous Commit
+
+```
+/simplify previous
+```
+
+Analyzes only the last commit (`git diff HEAD~1..HEAD`), even if there are uncommitted local changes.
+
+Aliases: `/simplify previous-commit`, `/simplify prev`, `/simplify last-commit`.
+
 ### Simplify Folders
 
 ```
@@ -83,12 +93,13 @@ Analyzes the specified folders/files as a snapshot (not a diff), even when there
 
 ## Commands
 
-| Command | Purpose |
-| --- | --- |
-| `/simplify` | Delete excess after a feature: dead code, debug remnants, thin wrappers |
-| `/simplify folder <paths>` | Same as above but snapshot mode (no git diff needed) |
-| `/code-smell` | Find structural problems: coupling, complexity, error handling, performance |
-| `/code-smell <paths>` | Scan specific paths for code smells |
+| Command                    | Purpose                                                                     |
+| -------------------------- | --------------------------------------------------------------------------- |
+| `/simplify`                | Delete excess after a feature: dead code, debug remnants, thin wrappers     |
+| `/simplify previous`       | Same as above but scoped to the previous commit (`HEAD~1..HEAD`)            |
+| `/simplify folder <paths>` | Same as above but snapshot mode (no git diff needed)                        |
+| `/code-smell`              | Find structural problems: coupling, complexity, error handling, performance |
+| `/code-smell <paths>`      | Scan specific paths for code smells                                         |
 
 ## Comparison with pi-review
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/pi-simplify",
-  "version": "0.1.0",
+  "version": "0.1.3",
   "description": "Simplify: Review changed code for reuse, quality, and efficiency",
   "keywords": [
     "pi-package"
@@ -9,24 +9,20 @@
   "author": "geminixiang",
   "repository": {
     "type": "git",
-    "url": "https://github.com/geminixiang/pi-simplify"
+    "url": "https://github.com/geminixiang/pi-stuff.git",
+    "directory": "packages/pi-simplify"
   },
   "main": "index.ts",
-  "scripts": {
-    "lint": "oxlint",
-    "lint:fix": "oxlint --fix",
-    "fmt": "oxfmt",
-    "fmt:check": "oxfmt --check"
-  },
-  "dependencies": {
-    "@earendil-works/pi-coding-agent": ">=0.74.0",
-    "@earendil-works/pi-tui": ">=0.74.0",
-    "typebox": "^1.1.38"
-  },
   "devDependencies": {
-    "oxfmt": "^0.45.0",
-    "oxlint": "^1.60.0",
-    "typescript": "^6.0.2"
+    "@earendil-works/pi-coding-agent": "^0.82.1",
+    "@earendil-works/pi-tui": "^0.82.1",
+    "typebox": "^1.1.38",
+    "typescript": "7.0.2"
+  },
+  "peerDependencies": {
+    "@earendil-works/pi-coding-agent": "*",
+    "@earendil-works/pi-tui": "*",
+    "typebox": "*"
   },
   "pi": {
     "extensions": [

package/src/code-smell/workflow.ts

@@ -9,6 +9,7 @@ import {
 import { Container, SelectList, Text, type SelectItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { assertRepositoryRelativePaths } from "../repository-path.js";
 import { runProgrammaticChecks } from "./checks.js";
 import { CODE_SMELL_PROMPT } from "./prompt.js";
 import { showFindingSelector } from "./selector.js";
@@ -164,7 +165,10 @@ function registerFindingsTool(
             category: categorySchema,
             severity: severitySchema,
             confidence: confidenceSchema,
-            file: Type.String({ minLength: 1, pattern: "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$" }),
+            file: Type.String({
+              description: "Repository-relative path without '..' segments",
+              minLength: 1,
+            }),
             lines: Type.String(),
             smell: Type.String({ minLength: 1 }),
             evidence: Type.String({ minLength: 1 }),
@@ -176,6 +180,8 @@ function registerFindingsTool(
       }),
       async execute(_toolCallId, params) {
         const findings: CodeSmellFinding[] = params.findings;
+        assertRepositoryRelativePaths(findings.map((finding) => finding.file));
+
         const resolve = state.getResolver();
         if (!resolve) {
           return {

package/src/repository-path.ts

@@ -0,0 +1,19 @@
+export function isRepositoryRelativePath(file: string): boolean {
+  const normalized = file.replaceAll("\\", "/");
+
+  return (
+    file.length > 0 &&
+    !normalized.startsWith("/") &&
+    !/^[A-Za-z]:\//.test(normalized) &&
+    !normalized.split("/").includes("..")
+  );
+}
+
+export function assertRepositoryRelativePaths(files: string[]): void {
+  const invalidFiles = files.filter((file) => !isRepositoryRelativePath(file));
+  if (invalidFiles.length === 0) return;
+
+  throw new Error(
+    `Expected repository-relative file paths without '..' segments; received: ${invalidFiles.join(", ")}`,
+  );
+}

package/src/simplify/workflow.ts

@@ -8,6 +8,7 @@ import {
 import { Container, SelectList, Text, type SelectItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { assertRepositoryRelativePaths } from "../repository-path.js";
 import { SIMPLIFY_PROMPT } from "./prompt.js";
 import { showCandidateSelector } from "./selector.js";
 import type { SimplifyResult } from "./types.js";
@@ -29,7 +30,10 @@ const actionSchema = Type.Union([
   Type.Literal("parallelize"),
 ]);
 
-type SimplifyTarget = { type: "uncommitted" } | { type: "folder"; paths: string[] };
+type SimplifyTarget =
+  | { type: "uncommitted" }
+  | { type: "previous-commit" }
+  | { type: "folder"; paths: string[] };
 type ParsedArgs = {
   target: SimplifyTarget | null;
   additionalFocus?: string;
@@ -38,6 +42,11 @@ type ParsedArgs = {
 
 const SIMPLIFY_PRESETS = [
   { value: "uncommitted", label: "Simplify uncommitted changes", description: "" },
+  {
+    value: "previous-commit",
+    label: "Simplify previous commit",
+    description: "(diff: HEAD~1..HEAD)",
+  },
   { value: "folder", label: "Simplify a folder (or more)", description: "(snapshot, not diff)" },
 ] as const;
 
@@ -55,14 +64,25 @@ function parseArgs(args: string): ParsedArgs {
   if (!trimmed) return { target: null };
 
   const [subcommand, ...rest] = trimmed.split(/\s+/);
-  if (subcommand?.toLowerCase() !== "folder") {
-    return { target: { type: "uncommitted" }, additionalFocus: trimmed };
+  const normalizedSubcommand = subcommand?.toLowerCase();
+
+  if (normalizedSubcommand === "folder") {
+    const paths = parseSimplifyPaths(rest.join(" "));
+    if (paths.length === 0)
+      return { target: null, error: "Usage: /simplify folder <path> [path...]" };
+    return { target: { type: "folder", paths } };
+  }
+
+  if (
+    normalizedSubcommand === "previous" ||
+    normalizedSubcommand === "previous-commit" ||
+    normalizedSubcommand === "prev" ||
+    normalizedSubcommand === "last-commit"
+  ) {
+    return { target: { type: "previous-commit" }, additionalFocus: rest.join(" ") || undefined };
   }
 
-  const paths = parseSimplifyPaths(rest.join(" "));
-  if (paths.length === 0)
-    return { target: null, error: "Usage: /simplify folder <path> [path...]" };
-  return { target: { type: "folder", paths } };
+  return { target: { type: "uncommitted" }, additionalFocus: trimmed };
 }
 
 async function hasUncommittedChanges(pi: ExtensionAPI): Promise<boolean> {
@@ -70,6 +90,11 @@ async function hasUncommittedChanges(pi: ExtensionAPI): Promise<boolean> {
   return code === 0 && stdout.trim().length > 0;
 }
 
+async function hasPreviousCommit(pi: ExtensionAPI): Promise<boolean> {
+  const { code } = await pi.exec("git", ["rev-parse", "--verify", "HEAD~1"]);
+  return code === 0;
+}
+
 function buildSimplifyPrompt(target: SimplifyTarget, additionalFocus?: string): string {
   let fullPrompt = SIMPLIFY_PROMPT;
 
@@ -77,6 +102,11 @@ function buildSimplifyPrompt(target: SimplifyTarget, additionalFocus?: string):
     fullPrompt += `\n\n## Scope Override: Folder Snapshot\n\nReview only the code in these repository-relative paths: ${target.paths.join(", ")}\n\nThis is a snapshot review, not a git diff review. Read files directly under these paths instead of relying on \`git diff\`. Only return candidates whose \`file\` is inside one of these paths.`;
   }
 
+  if (target.type === "previous-commit") {
+    fullPrompt +=
+      "\n\n## Scope Override: Previous Commit\n\nReview the previous commit only. Run `git diff HEAD~1..HEAD` to see what changed in the last commit, and treat that diff as the review scope. Do not use uncommitted changes as the analysis target. Only return candidates caused by the previous commit's diff.";
+  }
+
   if (additionalFocus?.trim()) fullPrompt += `\n\n## Additional Focus\n\n${additionalFocus.trim()}`;
   return fullPrompt;
 }
@@ -95,9 +125,8 @@ function registerSimplifyCandidatesTool(
         category: categorySchema,
         risk: riskSchema,
         file: Type.String({
-          description: "Repository-relative path",
+          description: "Repository-relative path without '..' segments",
           minLength: 1,
-          pattern: "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$",
         }),
         lines: Type.String({ description: "Line number or range, or empty string if unknown" }),
         rootIssue: Type.String({
@@ -133,6 +162,8 @@ function registerSimplifyCandidatesTool(
       parameters,
       async execute(_toolCallId, params) {
         const candidates: SimplifyResult[] = params.candidates;
+        assertRepositoryRelativePaths(candidates.map((candidate) => candidate.file));
+
         const resolve = state.getResolver();
         if (!resolve) {
           return {
@@ -243,6 +274,7 @@ async function showSimplifyTargetSelector(
 
     if (!result) return null;
     if (result === "uncommitted") return { type: "uncommitted" };
+    if (result === "previous-commit") return { type: "previous-commit" };
 
     const target = await showFolderInput(ctx);
     if (target) return target;
@@ -354,8 +386,20 @@ export function registerSimplifyWorkflow(pi: ExtensionAPI) {
         return;
       }
 
+      if (target.type === "previous-commit" && !(await hasPreviousCommit(pi))) {
+        ctx.ui.notify(
+          "No previous commit found. Need at least two commits to use this mode.",
+          "info",
+        );
+        return;
+      }
+
       const targetHint =
-        target.type === "folder" ? `folders: ${target.paths.join(", ")}` : "uncommitted changes";
+        target.type === "folder"
+          ? `folders: ${target.paths.join(", ")}`
+          : target.type === "previous-commit"
+            ? "previous commit"
+            : "uncommitted changes";
       ctx.ui.notify(`Analyzing ${targetHint} for review findings...`, "info");
 
       const fullPrompt = buildSimplifyPrompt(target, parsed.additionalFocus);

package/.github/workflows/publish.yml

@@ -1,56 +0,0 @@
-name: CI / Publish to npm
-
-on:
-  release:
-    types: [published]
-  push:
-    branches: [main]
-  workflow_dispatch:
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  ci:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Type check
-        run: npx tsc --noEmit --skipLibCheck || echo "No TypeScript, skipping type check"
-
-  publish:
-    needs: ci
-    runs-on: ubuntu-latest
-    if: github.event_name == 'release'
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: "24"
-          registry-url: "https://registry.npmjs.org"
-
-      - name: Update npm
-        run: npm install -g npm@latest
-
-      - name: Install dependencies
-        run: npm ci
-
-      - name: Publish to npm
-        run: |
-          VERSION=$(node -p "require('./package.json').version")
-          if [[ "$VERSION" == *-* ]]; then
-            npm publish --provenance --access public --tag beta
-          else
-            npm publish --provenance --access public
-          fi

package/.pi/skills/release/SKILL.md

@@ -1,146 +0,0 @@
----
-name: release
-description: Prepare and publish a new pi-simplify release. Use when bumping the version, committing and pushing it, and creating a GitHub release in the style of earlier pi-simplify releases.
----
-
-# pi-simplify Release
-
-Repo defaults:
-
-- branch: `main`
-- remote: `origin`
-- repo: `geminixiang/pi-simplify`
-- npm package: `@geminixiang/pi-simplify`
-- use `package.json` version for npm/package files, and `v<version>` for the git tag and GitHub release title
-- versions with `-alpha.`, `-beta.`, or `-rc.` are prereleases by default
-
-## Version rules
-
-Examples:
-
-- stable package version: `0.2.1`, `0.3.0`, `1.0.0` → release tag/title: `v0.2.1`, `v0.3.0`, `v1.0.0`
-- prerelease package version: `0.2.0-beta.8`, `0.3.0-rc.1`, `1.0.0-alpha.2` → release tag/title: `v0.2.0-beta.8`, `v0.3.0-rc.1`, `v1.0.0-alpha.2`
-
-Guidance:
-
-- `patch` = bugfix / small maintenance
-- `minor` = backward-compatible features
-- `major` = breaking changes
-- prerelease numbers increase within the same line, e.g. `beta.8 -> beta.9`
-- promote prerelease to stable by dropping the suffix, e.g. `0.2.0-beta.8 -> 0.2.0`
-
-## Flow
-
-### 1. Check state
-
-```bash
-git status --short
-git branch --show-current
-git remote -v
-git tag --list | tail -20
-```
-
-Read `package.json` and `package-lock.json`. If unrelated files are modified, ask before committing.
-
-### 2. Sync version files
-
-Preferred:
-
-```bash
-npm version <version> --no-git-tag-version
-```
-
-Use this to sync `package.json` and `package-lock.json` without creating an automatic commit or tag. If the user already edited `package.json`, just verify `package-lock.json` matches.
-
-### 3. Update CHANGELOG
-
-`CHANGELOG.md` follows Keep a Changelog with `### Added / Changed / Fixed / Removed / Security / Performance / Tests` subsections. The newest release sits at the top under an `## [Unreleased]` placeholder.
-
-Gather user-visible changes since the previous tag:
-
-```bash
-git log --pretty=format:'%h %s' <previous-tag>..HEAD | grep -v "^[a-f0-9]* chore: bump version"
-```
-
-Then in `CHANGELOG.md`:
-
-- Keep `## [Unreleased]` at the top as an empty placeholder.
-- Insert a new section `## [<version>] - <YYYY-MM-DD>` (use today's date for stable, omit the date for prereleases to match the existing style).
-- Group entries by subsection; one bullet per user-visible change, imperative voice, no commit hashes.
-- Skip pure internal refactors that don't change behavior unless they affect contributors (then list under `### Changed`).
-
-If you generated draft release notes in step 5 first, copy the same wording into CHANGELOG — they should match.
-
-### 4. Commit and push
-
-Stage version files and CHANGELOG together — the bump and the changelog entry belong in the same commit.
-
-```bash
-git add package.json package-lock.json CHANGELOG.md
-git commit -m "chore: bump version to <version>"
-git push origin main
-```
-
-### 5. Draft release notes
-
-Use the previous GitHub release as the style reference.
-
-```bash
-gh release list --repo geminixiang/pi-simplify --limit 10
-gh release view <previous-tag> --repo geminixiang/pi-simplify --json tagName,name,body,url,publishedAt
-git log --pretty=format:'%h %s' <previous-tag>..HEAD
-git diff --stat <previous-tag>..HEAD
-```
-
-Write concise notes focused on user-visible changes, usually with:
-
-- `## What's changed`
-- `### Highlights`
-- `### Notable changes`
-- `### Docs and maintenance`
-- `### Verification`
-
-Write notes to `/tmp/pi-simplify-release-<version>.md`. Keep them consistent with the CHANGELOG entry from step 3. Use `v<previous-version>...v<version>` in compare links.
-
-### 6. Create or update release
-
-Prerelease:
-
-```bash
-gh release create v<version> \
-  --repo geminixiang/pi-simplify \
-  --target main \
-  --title v<version> \
-  --notes-file /tmp/pi-simplify-release-<version>.md \
-  --prerelease
-```
-
-Stable:
-
-```bash
-gh release create v<version> \
-  --repo geminixiang/pi-simplify \
-  --target main \
-  --title v<version> \
-  --notes-file /tmp/pi-simplify-release-<version>.md
-```
-
-If it already exists, use `gh release edit v<version> ...` and keep prerelease/stable intent consistent.
-
-## Report back
-
-Return:
-
-- released version
-- stable or prerelease
-- version-bump commit hash
-- push status
-- release URL
-
-## Guardrails
-
-- Always use `geminixiang/pi-simplify`.
-- Infer stable vs prerelease from the version, or ask.
-- Do not include raw commit hashes in release notes unless requested.
-- If hooks fail during commit, fix or report before retrying.
-- Never publish a release without a corresponding CHANGELOG entry — the version bump commit must include the new CHANGELOG section.