@geminixiang/pi-simplify 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -6,6 +6,13 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.1.3] - 2026-09-07
+
+### Fixed
+
+- Move repository-relative path validation from tool-schema regex lookaheads to runtime checks for better provider compatibility in `/simplify` and `/code-smell`.
+- Reject absolute paths and parent-directory traversal using either forward slashes or backslashes.
+
 ## [0.1.2] - 2026-07-26
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/pi-simplify",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Simplify: Review changed code for reuse, quality, and efficiency",
   "keywords": [
     "pi-package"
@@ -13,19 +13,11 @@
     "directory": "packages/pi-simplify"
   },
   "main": "index.ts",
-  "scripts": {
-    "lint": "oxlint",
-    "lint:fix": "oxlint --fix",
-    "fmt": "oxfmt",
-    "fmt:check": "oxfmt --check"
-  },
   "devDependencies": {
     "@earendil-works/pi-coding-agent": "^0.82.1",
     "@earendil-works/pi-tui": "^0.82.1",
-    "oxfmt": "^0.45.0",
-    "oxlint": "^1.60.0",
     "typebox": "^1.1.38",
-    "typescript": "^6.0.2"
+    "typescript": "7.0.2"
   },
   "peerDependencies": {
     "@earendil-works/pi-coding-agent": "*",

package/src/code-smell/workflow.ts

@@ -9,6 +9,7 @@ import {
 import { Container, SelectList, Text, type SelectItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { assertRepositoryRelativePaths } from "../repository-path.js";
 import { runProgrammaticChecks } from "./checks.js";
 import { CODE_SMELL_PROMPT } from "./prompt.js";
 import { showFindingSelector } from "./selector.js";
@@ -164,7 +165,10 @@ function registerFindingsTool(
             category: categorySchema,
             severity: severitySchema,
             confidence: confidenceSchema,
-            file: Type.String({ minLength: 1, pattern: "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$" }),
+            file: Type.String({
+              description: "Repository-relative path without '..' segments",
+              minLength: 1,
+            }),
             lines: Type.String(),
             smell: Type.String({ minLength: 1 }),
             evidence: Type.String({ minLength: 1 }),
@@ -176,6 +180,8 @@ function registerFindingsTool(
       }),
       async execute(_toolCallId, params) {
         const findings: CodeSmellFinding[] = params.findings;
+        assertRepositoryRelativePaths(findings.map((finding) => finding.file));
+
         const resolve = state.getResolver();
         if (!resolve) {
           return {

package/src/repository-path.ts

@@ -0,0 +1,19 @@
+export function isRepositoryRelativePath(file: string): boolean {
+  const normalized = file.replaceAll("\\", "/");
+
+  return (
+    file.length > 0 &&
+    !normalized.startsWith("/") &&
+    !/^[A-Za-z]:\//.test(normalized) &&
+    !normalized.split("/").includes("..")
+  );
+}
+
+export function assertRepositoryRelativePaths(files: string[]): void {
+  const invalidFiles = files.filter((file) => !isRepositoryRelativePath(file));
+  if (invalidFiles.length === 0) return;
+
+  throw new Error(
+    `Expected repository-relative file paths without '..' segments; received: ${invalidFiles.join(", ")}`,
+  );
+}

package/src/simplify/workflow.ts

@@ -8,6 +8,7 @@ import {
 import { Container, SelectList, Text, type SelectItem } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 
+import { assertRepositoryRelativePaths } from "../repository-path.js";
 import { SIMPLIFY_PROMPT } from "./prompt.js";
 import { showCandidateSelector } from "./selector.js";
 import type { SimplifyResult } from "./types.js";
@@ -124,9 +125,8 @@ function registerSimplifyCandidatesTool(
         category: categorySchema,
         risk: riskSchema,
         file: Type.String({
-          description: "Repository-relative path",
+          description: "Repository-relative path without '..' segments",
           minLength: 1,
-          pattern: "^(?!/)(?!.*(?:^|/)\\.\\.(?:/|$)).+$",
         }),
         lines: Type.String({ description: "Line number or range, or empty string if unknown" }),
         rootIssue: Type.String({
@@ -162,6 +162,8 @@ function registerSimplifyCandidatesTool(
       parameters,
       async execute(_toolCallId, params) {
         const candidates: SimplifyResult[] = params.candidates;
+        assertRepositoryRelativePaths(candidates.map((candidate) => candidate.file));
+
         const resolve = state.getResolver();
         if (!resolve) {
           return {