@maxiaochao/pi-toolkit 0.13.7 → 0.13.8

package/packages/cache-export/tests/extension.mjs

@@ -0,0 +1,52 @@
+import "../../background-tasks/tests/runtime.mjs";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import cacheExport from "../extensions/cache-export.ts";
+import { parseEntries } from "../src/render.ts";
+const { createAgentSession, DefaultResourceLoader, ModelRuntime, SessionManager, SettingsManager } = await import("@earendil-works/pi-coding-agent");
+const { createAssistantMessageEventStream } = await import("@earendil-works/pi-ai");
+const root = mkdtempSync(join(tmpdir(), "cache-sdk-"));
+const runtime = await ModelRuntime.create({ authPath: join(root, "auth.json"), modelsPath: join(root, "models.json"), refreshOnCreate: false });
+let session;
+try {
+  runtime.registerProvider("cache-fixture", {
+    api: "cache-fixture", apiKey: "not-secret", baseUrl: "http://127.0.0.1:1",
+    models: [{ id: "offline", name: "Offline", input: ["text"], reasoning: false, contextWindow: 128000, maxTokens: 4096, promptCache: { short: 300, long: 86400 }, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0 } }],
+    streamSimple(model, _context, options) {
+      const stream = createAssistantMessageEventStream();
+      const timestamp = Date.now();
+      queueMicrotask(async () => {
+        await options.onPayload?.({ prompt_cache_retention: "24h", prompt_cache_key: "SECRET_KEY", input: "SECRET_PAYLOAD" }, model);
+        const message = { role: "assistant", provider: model.provider, api: model.api, model: model.id, timestamp, durationMs: 10, content: [{ type: "text", text: "offline" }], stopReason: "stop", usage: { input: 100, output: 1, cacheRead: 1000, cacheWrite: 0, totalTokens: 1101, cost: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, total: 0 } } };
+        stream.push({ type: "start", partial: message });
+        stream.push({ type: "done", reason: "stop", message });
+      });
+      return stream;
+    },
+  });
+  const settingsManager = SettingsManager.inMemory({ retry: { enabled: false }, compaction: { enabled: false }, cacheWarming: "off" });
+  const resourceLoader = new DefaultResourceLoader({ cwd: root, agentDir: root, settingsManager, noExtensions: true, noSkills: true, noPromptTemplates: true, noThemes: true, noContextFiles: true, extensionFactories: [cacheExport] });
+  await resourceLoader.reload();
+  const created = await createAgentSession({ cwd: root, agentDir: root, modelRuntime: runtime, model: runtime.getModel("cache-fixture", "offline"), resourceLoader, settingsManager, sessionManager: SessionManager.inMemory(root), tools: [] });
+  session = created.session;
+  assert.deepEqual(created.extensionsResult.errors, []);
+  const errors = [];
+  session.extensionRunner.onError((error) => errors.push(error));
+  await session.bindExtensions({});
+  await session.prompt("Produce deterministic usage.");
+  const entries = session.sessionManager.getBranch();
+  const data = parseEntries(entries);
+  assert.equal(data.requests.length, 1);
+  assert.equal(data.requests[0].policyReferenceSeconds, 86400, "native hook observation must survive projection and match its assistant message");
+  assert.equal(data.requests[0].durationMs, 10);
+  assert.doesNotMatch(JSON.stringify(entries), /SECRET_KEY|SECRET_PAYLOAD/);
+  await session.prompt("/cache_export native.html");
+  assert.match(readFileSync(join(root, "native.html"), "utf8"), /86400s recorded reference/);
+  assert.deepEqual(errors, []);
+  console.log("PASS native Pi cache export: safe request evidence, message correlation, session-relative path");
+} finally {
+  if (session) { await session.abort(); session.dispose(); }
+  rmSync(root, { recursive: true, force: true });
+}

package/packages/cache-export/tests/run-tests.mjs

@@ -118,14 +118,14 @@ const hitOf = (r) => r.cached / (r.fresh + r.cached + r.cacheWrite);
   check("G fresh=799 -> not member", analyzeStreaks(parseEntries(mk3(7190, 799)).requests).length === 0);
 }
 
-// H. TTL expiry attribution ---------------------------------------------
+// H. Unknown historical timing/policy ---------------------------------------------
 {
   const entries = [
     req({ cached: 50000, fresh: 2000, min: 1 }),
     req({ cached: 5000, fresh: 15000, min: 40 }), // 39min gap same model, hit .25
   ];
   const m = analyzeMisses(parseEntries(entries).requests, parseEntries(entries).events);
-  check("H 39min gap + low hit -> possible TTL expiry", m.misses.length === 1 && m.misses[0].causes.some(([c]) => c === "possible TTL expiry"),
+  check("H missing request timing/policy -> no invented TTL expiry", m.misses.length === 1 && !m.misses[0].causes.some(([c]) => c === "possible TTL expiry"),
     JSON.stringify(m.misses.map((x) => x.causes)));
 }
 
@@ -156,7 +156,7 @@ const hitOf = (r) => r.cached / (r.fresh + r.cached + r.cacheWrite);
     JSON.stringify(two && two.causes));
 }
 
-// H4. 1h retention survives intervening read-only requests -----------------
+// H4. One-hour write references do not establish later expiry -----------------
 {
   const entries = [
     req({ cached: 0, fresh: 2000, write: 50000, write1h: 50000, min: 1, api: "anthropic-messages" }),
@@ -165,13 +165,13 @@ const hitOf = (r) => r.cached / (r.fresh + r.cached + r.cacheWrite);
   ];
   const d = parseEntries(entries);
   const three = analyzeMisses(d.requests, d.events).misses.find((x) => x.number === 3);
-  check("H4 inherited 1h window -> rebuild, not TTL expiry",
-    d.requests[1].cacheTtlMinutes === 60 && three && three.causes.some(([cause]) => cause === "cache rebuild") &&
+  check("H4 no invented expiry after intervening reported reads",
+    d.requests[0].policyReferenceSeconds === 3600 && d.requests[1].policyReferenceSeconds === null && three && three.causes.some(([cause]) => cause === "cache rebuild") &&
       !three.causes.some(([cause]) => cause === "possible TTL expiry"),
-    JSON.stringify({ ttl: d.requests[1].cacheTtlMinutes, causes: three && three.causes }));
+    JSON.stringify({ reference: d.requests[1].policyReferenceSeconds, causes: three && three.causes }));
 }
 
-// H5. short-lived replacement clears an older 1h retention window ----------
+// H5. Replacement without historical policy remains unknown ----------
 {
   const entries = [
     req({ cached: 0, fresh: 2000, write: 50000, write1h: 50000, min: 1, api: "anthropic-messages" }),
@@ -180,9 +180,9 @@ const hitOf = (r) => r.cached / (r.fresh + r.cached + r.cacheWrite);
   ];
   const d = parseEntries(entries);
   const three = analyzeMisses(d.requests, d.events).misses.find((x) => x.number === 3);
-  check("H5 short replacement resets TTL to 5min",
-    d.requests[1].cacheTtlMinutes === 5 && three && three.causes.some(([cause]) => cause === "possible TTL expiry"),
-    JSON.stringify({ ttl: d.requests[1].cacheTtlMinutes, causes: three && three.causes }));
+  check("H5 replacement without TTL metadata remains unknown",
+    d.requests[1].policyReferenceSeconds === null && three && !three.causes.some(([cause]) => cause === "possible TTL expiry"),
+    JSON.stringify({ reference: d.requests[1].policyReferenceSeconds, causes: three && three.causes }));
 }
 
 // I. cache rebuild (prev turn was a miss, same model) -------------------
@@ -393,8 +393,9 @@ const hitOf = (r) => r.cached / (r.fresh + r.cached + r.cacheWrite);
   const active = entry(req({ cached: 8000, fresh: 2000, min: 3, model: "active-model" }), "p3", "p1");
 
   let command;
-  registerCacheExport({ registerCommand: (name, definition) => { if (name === "cache_export") command = definition; } });
+  registerCacheExport({ on() {}, registerCommand: (name, definition) => { if (name === "cache_export") command = definition; } });
   await command.handler(reportFile, {
+    cwd: root,
     sessionManager: {
       getBranch: () => [first, active],
       getEntries: () => [first, abandoned, active],

package/packages/codex-edit/CHANGELOG.md

@@ -1,3 +1,10 @@
+## Unreleased
+
+- Reject file/ancestor target conflicts before any patch writes, regardless of operation order.
+- Preserve ordinary source permission bits on Move, including executable bits and permissions masked by umask.
+- Add real-filesystem cases to the shared corpus. Keep the frozen parser baseline unchanged and mark filesystem-only baseline comparisons unsupported.
+- Keep expected-failure assertions outside exception handlers so unexpected success cannot pass as rejection.
+
 ## 2026-10-21 - v0.2.0
 
 - persist personal routing rules in the Pi agent directory across package updates

package/packages/codex-edit/README.md

@@ -136,3 +136,7 @@ Herdr Subagents does not automatically inherit the parent's extensions. To enabl
 - `docs/test-report.html`: current self-contained report; its authoritative source is `docs/test-report.md`.
 
 The historical 20-case benchmark found equal final correctness, with first editor-call success improving from 85% to 95%. The completed frozen 100-task three-arm benchmark (`explicit-edit-100-sol-low-v3-complete`) ran all 300 chains: native and released v0.1.7 scored 91.25%, while the local version scored 92.00%. All arms reached 92% Final Exact, all eight final failures were shared, and there was no local-only final regression. The sanitized run evidence is committed under `benchmark/results/`; the generated report contains the full methodology, paired results, efficiency, and safety evidence.
+
+## Filesystem safety
+
+Preflight rejects file/parent target conflicts before any write. Move preserves ordinary permission bits, including executable bits. These checks prevent predictable path conflicts; they do not promise cross-file rollback for arbitrary disk failures. Real-filesystem regressions cover both operation orders, unchanged original bytes after rejection, and moved-file permissions.

package/packages/codex-edit/TESTING.md

@@ -57,3 +57,7 @@
 `summary.md` 的 20-case 报告是历史证据。当前正式运行 `explicit-edit-100-sol-low-v3-complete` 已完成 300/300 条 chain，实际成本 $12.388；本地版 First Exact 92%、Final Exact 92%、Score v2 92.00%，满足全部正式门槛。原生与发布版均为 First 91%、Final 92%、Score v2 91.25%；8 个最终失败为三臂共同例外，本地独有最终回归为 0。
 
 公开、去敏后的正式证据提交在 `benchmark/results/explicit-edit-100-sol-low-v3.json`。正常测试只读取该文件，因此干净 checkout 不依赖 `.cache`，且 Markdown 与 HTML 可逐字节重建。导入新运行时，使用 `benchmark/export-evidence.mjs <run-directory> <output.json>`；只有在确认运行完整性、配置 identity 和无敏感字段后才替换正式证据。预算必须在每次运行前声明 scheduling stop 与 hard cap，预算停止的前缀一律标为 INCOMPLETE，禁止选择性补跑后宣称完整。任何模型路由、prompt 或 tool schema 变化仍需重跑独立模型基准，不能用 parser 测试替代。
+
+## Filesystem review regressions
+
+The shared comparison corpus includes two file/parent conflicts (both orderings) and a move preserving `0755`. The local extension runs against real temporary files; rejection must leave all original bytes unchanged. Native edit and the frozen released parser baseline cannot exercise these filesystem operations, so those arms are explicitly unsupported, not fabricated successes. The released parser file remains unchanged. Ordinary permission bits are tested on POSIX; no arbitrary disk-failure transaction rollback is claimed.

package/packages/codex-edit/docs/test-report.html

@@ -16,9 +16,9 @@
 <main><div class="eyebrow">GPT-5.6 Sol / Pi 0.85.1 / Explicit Edit Benchmark</div><h1 id="top">Codex Edit 测试报告</h1>
 <p><strong>回归检查：通过；Agent Benchmark：通过（有共同例外）</strong></p>
 <p>被测包：<code>@maxiaochao/pi-codex-edit</code>（当前工作区）</p>
-<p>本报告严格区分真实模型基准、确定性协议回归和安全回归，三类成功率不会混算。</p>
+<p>本报告严格区分真实模型基准、确定性协议回归和安全回归，三类成功率不会混算。 Agent Benchmark 是已提交的历史运行证据，不代表本次文件系统修复重新运行了付费模型基准。</p>
 <h2 id="summary">执行摘要</h2>
-<ul><li>Agent Benchmark：<strong>通过（有共同例外）</strong> — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。</li><li>协议/包回归：<strong>通过</strong> — 5/5 项检查通过。</li><li>安全回归：<strong>5/5 正确拒绝且零写入</strong>，包括工作区外路径。</li><li>下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。</li></ul>
+<ul><li>Agent Benchmark：<strong>通过（有共同例外）</strong> — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。</li><li>协议/包回归：<strong>通过</strong> — 5/5 项检查通过。</li><li>安全回归：<strong>7/7 正确拒绝且零写入</strong>，包括工作区外路径。</li><li>下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。</li></ul>
 <h2 id="benchmark">Agent Benchmark：真实模型基准</h2>
 <p><strong>状态：通过（有共同例外）</strong></p>
 <p>三个测试臂均完成全部 100 个配对任务（共 300 条 chain），实际成本为 $12.388。本地版满足全部正式验收门槛；8 个最终失败均为三臂共同失败，不是本地版独有回归。</p>
@@ -95,10 +95,10 @@
 <tr><td>独立包 tarball</td><td>通过</td><td><code>npm pack --dry-run --json</code></td></tr>
 </tbody></table></div>
 <h2 id="section-4">确定性回归基线</h2>
-<ul><li>Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。</li><li>共享对比 corpus：12 个 case。</li><li>原生 edit：5 通过 / 2 失败或正确拒绝 / 5 不适用。</li><li>Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝。</li><li>Codex Edit 本地版：7 通过 / 5 正确安全拒绝。</li></ul>
-<p>“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示 Pi 原生 <code>edit</code> 无法用一次编辑协议调用表达该操作，不计为工具缺陷。</p>
+<ul><li>Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。</li><li>共享对比 corpus：15 个 case。</li><li>原生 edit：5 通过 / 2 失败或正确拒绝 / 8 不适用。</li><li>Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝 / 3 不适用。</li><li>Codex Edit 本地版：8 通过 / 7 正确安全拒绝。</li></ul>
+<p>“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示原生 edit 无法表达该操作，或冻结的发布版 parser 基线不包含文件系统执行层；不计为工具缺陷。层级冲突与权限保留使用本地扩展和真实临时文件验证，不伪造发布版执行结果。</p>
 <h2 id="safety">安全回归</h2>
-<p>本地版 5/5 个安全 case 均正确拒绝，且工作区零写入。特别是 <code>outside-workspace-absolute-path</code> 的结果为 <strong>工作区外路径 — 正确拒绝</strong>；放行该操作会允许任意写入 benchmark sandbox 之外。安全拒绝不计入编辑失败率。</p>
+<p>本地版 7/7 个安全 case 均正确拒绝，且工作区零写入。特别是 <code>outside-workspace-absolute-path</code> 的结果为 <strong>工作区外路径 — 正确拒绝</strong>；放行该操作会允许任意写入 benchmark sandbox 之外。安全拒绝不计入编辑失败率。</p>
 <h2 id="incidents">生产事故回归</h2>
 <p>这些 case 来自实际报告过的问题。Agent-and-protocol case 使用不包含工具语法提示的用户任务，可进入后续付费模型运行；protocol-only case 只验证指定工具形态，不用于宣称模型质量提升。</p>
 <div class="table-wrap"><table><thead><tr><th>Incident</th><th>层级</th><th>对应回归</th><th>问题</th></tr></thead><tbody>
@@ -110,14 +110,14 @@
 </tbody></table></div>
 <p>冻结的 100-task 清单按每 5 个任务包含 4 Neutral + 1 Challenge 的顺序调度；本次完整运行覆盖全部 80 个 Neutral 和 20 个 Challenge。</p>
 <h2 id="comparison">确定性对比结论</h2>
-<p>每个测试臂运行同一组 12 个 case。对比 1 执行 24 次工具调用（原生 + 本地）；对比 2 执行 24 次 parser/执行评估（发布版 + 本地）。下表以 7 个有效编辑任务为完成率分母；5 个故意无效或危险的 patch 单独计入安全检查。</p>
+<p>共享语料共 15 个 case。不适用的测试臂不执行。对比 1 验证本地扩展的 8 个有效编辑和 7 个安全 case；对比 2 只比较 parser 基线适用的 7 个有效编辑和 5 个安全 case。</p>
 <h3 id="1-pi-edit-vs-codex-edit">1. Pi 原生 edit vs Codex Edit 本地版</h3>
 <div class="table-wrap"><table><thead><tr><th>指标</th><th>Pi 原生 edit</th><th>Codex Edit 本地版</th><th>变化</th></tr></thead><tbody>
-<tr><td>有效任务完成</td><td>5/7</td><td>7/7</td><td>+2 个</td></tr>
-<tr><td>有效任务完成率</td><td>71.4%</td><td>100.0%</td><td>+28.6 pp</td></tr>
-<tr><td>有效任务失败</td><td>1/7</td><td>0/7</td><td>减少 1 个</td></tr>
-<tr><td>有效任务不适用</td><td>1/7</td><td>0/7</td><td>减少 1 个</td></tr>
-<tr><td>正确拒绝适用的危险/陈旧 patch</td><td>1/1 (100.0%)</td><td>5/5 (100.0%)</td><td>Codex 覆盖全部 5 个</td></tr>
+<tr><td>有效任务完成</td><td>5/8</td><td>8/8</td><td>+3 个</td></tr>
+<tr><td>有效任务完成率</td><td>62.5%</td><td>100.0%</td><td>+37.5 pp</td></tr>
+<tr><td>有效任务失败</td><td>1/8</td><td>0/8</td><td>减少 1 个</td></tr>
+<tr><td>有效任务不适用</td><td>2/8</td><td>0/8</td><td>减少 2 个</td></tr>
+<tr><td>正确拒绝适用的危险/陈旧 patch</td><td>1/1 (100.0%)</td><td>7/7 (100.0%)</td><td>Codex 覆盖全部 7 个</td></tr>
 </tbody></table></div>
 <h3 id="2-codex-edit-v0-1-7-vs">2. Codex Edit 发布版 v0.1.7 vs 本地修改版</h3>
 <div class="table-wrap"><table><thead><tr><th>指标</th><th>发布版 v0.1.7</th><th>本地修改版</th><th>变化</th></tr></thead><tbody>
@@ -130,6 +130,9 @@
 <h2 id="case-edit-vs-codex-edit">逐 case：原生 edit vs 本地 Codex Edit</h2>
 <p>该对比在隔离临时工作区中执行 Pi 导出的 <code>createEditToolDefinition</code>，以及本地扩展实际注册的 <code>apply_patch</code>。</p>
 <div class="table-wrap"><table><thead><tr><th>Case</th><th>原生 edit</th><th>本地 Codex Edit</th><th>说明</th></tr></thead><tbody>
+<tr><td><code>file-parent-conflict</code></td><td>不适用</td><td>正确拒绝/失败</td><td>两者均避免危险写入</td></tr>
+<tr><td><code>file-parent-conflict-reversed</code></td><td>不适用</td><td>正确拒绝/失败</td><td>两者均避免危险写入</td></tr>
+<tr><td><code>move-preserves-file-mode</code></td><td>不适用</td><td>通过</td><td>Codex 协议可处理该形态</td></tr>
 <tr><td><code>unique-replacement</code></td><td>通过</td><td>通过</td><td>预期行为一致</td></tr>
 <tr><td><code>disjoint-edits-one-file</code></td><td>通过</td><td>通过</td><td>预期行为一致</td></tr>
 <tr><td><code>repeated-markdown-separator</code></td><td>正确拒绝/失败</td><td>通过</td><td>Codex 协议可处理该形态</td></tr>
@@ -147,6 +150,9 @@
 <h2 id="case-v0-1-7-vs-codex-edit">逐 case：发布版 v0.1.7 vs 本地 Codex Edit</h2>
 <p>发布版测试臂使用从 tag <code>codex-edit-v0.1.7</code> 冻结的语义基线（source blob <code>e2896b59d40b5f6f01b3a4a7918476f4acc28cd8</code>）。</p>
 <div class="table-wrap"><table><thead><tr><th>Case</th><th>发布版 v0.1.7</th><th>本地版</th><th>回归状态</th></tr></thead><tbody>
+<tr><td><code>file-parent-conflict</code></td><td>不适用</td><td>正确拒绝/失败</td><td>仅本地真实文件验证</td></tr>
+<tr><td><code>file-parent-conflict-reversed</code></td><td>不适用</td><td>正确拒绝/失败</td><td>仅本地真实文件验证</td></tr>
+<tr><td><code>move-preserves-file-mode</code></td><td>不适用</td><td>通过</td><td>仅本地真实文件验证</td></tr>
 <tr><td><code>unique-replacement</code></td><td>通过</td><td>通过</td><td>已保留</td></tr>
 <tr><td><code>disjoint-edits-one-file</code></td><td>通过</td><td>通过</td><td>已保留</td></tr>
 <tr><td><code>repeated-markdown-separator</code></td><td>通过</td><td>通过</td><td>已保留</td></tr>
@@ -167,6 +173,8 @@
 <tr><td>同一 raw path 出现多个普通 <code>Update File</code></td><td>合并后按顺序执行</td><td><code>repeated-update-same-path</code></td></tr>
 <tr><td>Add/delete/move 或 resolved path alias 冲突</td><td>写入前拒绝</td><td><code>conflicting-targets</code>、<code>resolved-path-alias-conflict</code></td></tr>
 <tr><td>工作区外绝对路径</td><td>读取或写入前正确拒绝</td><td><code>outside-workspace-absolute-path</code></td></tr>
+<tr><td>文件与父目录层级冲突</td><td>任意操作写入前拒绝，两种顺序均零写入</td><td><code>file-parent-conflict</code>、<code>file-parent-conflict-reversed</code></td></tr>
+<tr><td>Move 丢失执行权限</td><td>保留源文件普通权限位，不受 umask 截断</td><td><code>move-preserves-file-mode</code></td></tr>
 <tr><td>空 update chunk</td><td>拒绝，不猜测意图</td><td><code>empty-update-chunk</code></td></tr>
 <tr><td>陈旧预期行</td><td>拒绝；调用方必须重新读取并生成 patch</td><td><code>stale-expected-lines</code></td></tr>
 <tr><td>缺少 <code>patch</code> 参数</td><td>必填 TypeBox schema 在扩展执行前拒绝</td><td>包契约测试</td></tr>

package/packages/codex-edit/docs/test-report.md

@@ -5,12 +5,13 @@
 被测包：`@maxiaochao/pi-codex-edit`（当前工作区）
 
 本报告严格区分真实模型基准、确定性协议回归和安全回归，三类成功率不会混算。
+Agent Benchmark 是已提交的历史运行证据，不代表本次文件系统修复重新运行了付费模型基准。
 
 ## 执行摘要
 
 - Agent Benchmark：**通过（有共同例外）** — 已完成 300/300 条 chain；本地版 First Exact 92/100、Final Exact 92/100，全部正式门槛通过。
 - 协议/包回归：**通过** — 5/5 项检查通过。
-- 安全回归：**5/5 正确拒绝且零写入**，包括工作区外路径。
+- 安全回归：**7/7 正确拒绝且零写入**，包括工作区外路径。
 - 下文提供 Agent、协议、安全、效率、版本、integrity 和任务来源的完整证据。
 
 ## Agent Benchmark：真实模型基准
@@ -123,16 +124,16 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 ## 确定性回归基线
 
 - Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。
-- 共享对比 corpus：12 个 case。
-- 原生 edit：5 通过 / 2 失败或正确拒绝 / 5 不适用。
-- Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝。
-- Codex Edit 本地版：7 通过 / 5 正确安全拒绝。
+- 共享对比 corpus：15 个 case。
+- 原生 edit：5 通过 / 2 失败或正确拒绝 / 8 不适用。
+- Codex Edit 发布版 v0.1.7：6 通过 / 6 失败或正确拒绝 / 3 不适用。
+- Codex Edit 本地版：8 通过 / 7 正确安全拒绝。
 
-“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示 Pi 原生 `edit` 无法用一次编辑协议调用表达该操作，不计为工具缺陷。
+“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示原生 edit 无法表达该操作，或冻结的发布版 parser 基线不包含文件系统执行层；不计为工具缺陷。层级冲突与权限保留使用本地扩展和真实临时文件验证，不伪造发布版执行结果。
 
 ## 安全回归
 
-本地版 5/5 个安全 case 均正确拒绝，且工作区零写入。特别是 `outside-workspace-absolute-path` 的结果为 **工作区外路径 — 正确拒绝**；放行该操作会允许任意写入 benchmark sandbox 之外。安全拒绝不计入编辑失败率。
+本地版 7/7 个安全 case 均正确拒绝，且工作区零写入。特别是 `outside-workspace-absolute-path` 的结果为 **工作区外路径 — 正确拒绝**；放行该操作会允许任意写入 benchmark sandbox 之外。安全拒绝不计入编辑失败率。
 
 ## 生产事故回归
 
@@ -150,17 +151,17 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 
 ## 确定性对比结论
 
-每个测试臂运行同一组 12 个 case。对比 1 执行 24 次工具调用（原生 + 本地）；对比 2 执行 24 次 parser/执行评估（发布版 + 本地）。下表以 7 个有效编辑任务为完成率分母；5 个故意无效或危险的 patch 单独计入安全检查。
+共享语料共 15 个 case。不适用的测试臂不执行。对比 1 验证本地扩展的 8 个有效编辑和 7 个安全 case；对比 2 只比较 parser 基线适用的 7 个有效编辑和 5 个安全 case。
 
 ### 1. Pi 原生 edit vs Codex Edit 本地版
 
 | 指标 | Pi 原生 edit | Codex Edit 本地版 | 变化 |
 |---|---:|---:|---:|
-| 有效任务完成 | 5/7 | 7/7 | +2 个 |
-| 有效任务完成率 | 71.4% | 100.0% | +28.6 pp |
-| 有效任务失败 | 1/7 | 0/7 | 减少 1 个 |
-| 有效任务不适用 | 1/7 | 0/7 | 减少 1 个 |
-| 正确拒绝适用的危险/陈旧 patch | 1/1 (100.0%) | 5/5 (100.0%) | Codex 覆盖全部 5 个 |
+| 有效任务完成 | 5/8 | 8/8 | +3 个 |
+| 有效任务完成率 | 62.5% | 100.0% | +37.5 pp |
+| 有效任务失败 | 1/8 | 0/8 | 减少 1 个 |
+| 有效任务不适用 | 2/8 | 0/8 | 减少 2 个 |
+| 正确拒绝适用的危险/陈旧 patch | 1/1 (100.0%) | 7/7 (100.0%) | Codex 覆盖全部 7 个 |
 
 ### 2. Codex Edit 发布版 v0.1.7 vs 本地修改版
 
@@ -179,6 +180,9 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 
 | Case | 原生 edit | 本地 Codex Edit | 说明 |
 |---|---|---|---|
+| `file-parent-conflict` | 不适用 | 正确拒绝/失败 | 两者均避免危险写入 |
+| `file-parent-conflict-reversed` | 不适用 | 正确拒绝/失败 | 两者均避免危险写入 |
+| `move-preserves-file-mode` | 不适用 | 通过 | Codex 协议可处理该形态 |
 | `unique-replacement` | 通过 | 通过 | 预期行为一致 |
 | `disjoint-edits-one-file` | 通过 | 通过 | 预期行为一致 |
 | `repeated-markdown-separator` | 正确拒绝/失败 | 通过 | Codex 协议可处理该形态 |
@@ -200,6 +204,9 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 
 | Case | 发布版 v0.1.7 | 本地版 | 回归状态 |
 |---|---|---|---|
+| `file-parent-conflict` | 不适用 | 正确拒绝/失败 | 仅本地真实文件验证 |
+| `file-parent-conflict-reversed` | 不适用 | 正确拒绝/失败 | 仅本地真实文件验证 |
+| `move-preserves-file-mode` | 不适用 | 通过 | 仅本地真实文件验证 |
 | `unique-replacement` | 通过 | 通过 | 已保留 |
 | `disjoint-edits-one-file` | 通过 | 通过 | 已保留 |
 | `repeated-markdown-separator` | 通过 | 通过 | 已保留 |
@@ -223,6 +230,8 @@ Score v2 = `覆盖率 ×（0.75 × 首次精确率 + 0.25 × 最终精确率）`
 | 同一 raw path 出现多个普通 `Update File` | 合并后按顺序执行 | `repeated-update-same-path` |
 | Add/delete/move 或 resolved path alias 冲突 | 写入前拒绝 | `conflicting-targets`、`resolved-path-alias-conflict` |
 | 工作区外绝对路径 | 读取或写入前正确拒绝 | `outside-workspace-absolute-path` |
+| 文件与父目录层级冲突 | 任意操作写入前拒绝，两种顺序均零写入 | `file-parent-conflict`、`file-parent-conflict-reversed` |
+| Move 丢失执行权限 | 保留源文件普通权限位，不受 umask 截断 | `move-preserves-file-mode` |
 | 空 update chunk | 拒绝，不猜测意图 | `empty-update-chunk` |
 | 陈旧预期行 | 拒绝；调用方必须重新读取并生成 patch | `stale-expected-lines` |
 | 缺少 `patch` 参数 | 必填 TypeBox schema 在扩展执行前拒绝 | 包契约测试 |

package/packages/codex-edit/docs/test-summary.md

@@ -2,7 +2,7 @@
 
 - Agent Benchmark：**通过（有共同例外）** — 完成 300/300 条 chain；全部正式验收门槛通过。
 - 协议/包回归：**通过** — 5/5 项检查通过。
-- 安全回归：**5/5 正确拒绝**，覆盖陈旧上下文、空 chunk、目标冲突、resolved alias 和工作区外路径。
+- 安全回归：**7/7 正确拒绝**，覆盖陈旧上下文、空 chunk、目标冲突、resolved alias 和工作区外路径。
 - First Exact：原生 edit 91/100，发布版 91/100，本地版 92/100；Final Exact：三臂均为 92/100。
 - 总成本：$12.388；Provider 失败：0。
 

package/packages/codex-edit/extensions/codex-edit.ts

@@ -1,4 +1,4 @@
-import { access, lstat, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { access, chmod, lstat, mkdir, readFile, unlink, writeFile } from "node:fs/promises";
 import { constants } from "node:fs";
 import { dirname } from "node:path";
 import { Text } from "@earendil-works/pi-tui";
@@ -114,6 +114,12 @@ export default async function (pi) {
         resolved.push({ ...operation, source, destination });
       }
       if (new Set(targets).size !== targets.length) throw new Error("Multiple patch operations target the same resolved path");
+      const targetSet = new Set(targets);
+      for (const target of targets) {
+        for (let parent = dirname(target); parent !== dirname(parent); parent = dirname(parent)) {
+          if (targetSet.has(parent)) throw new Error(`Patch file target is also a parent directory: ${parent}`);
+        }
+      }
 
       const committed = [];
       return withPathQueues(targets, async () => {
@@ -126,7 +132,7 @@ export default async function (pi) {
             if (await pathExists(operation.source)) throw new Error(`Cannot add existing file ${operation.path}`);
             prepared.push({ ...operation, before: "", after: operation.content });
           } else {
-            await fileInfo(operation.source, `Source file ${operation.path}`);
+            const info = await fileInfo(operation.source, `Source file ${operation.path}`);
             const before = await readFile(operation.source, "utf8");
             const after = operation.action === "delete"
               ? ""
@@ -134,7 +140,7 @@ export default async function (pi) {
             if (operation.destination && await pathExists(operation.destination)) {
               throw new Error(`Cannot move over existing file ${operation.moveTo}`);
             }
-            prepared.push({ ...operation, before, after });
+            prepared.push({ ...operation, before, after, mode: info.mode & 0o777 });
           }
         }
 
@@ -147,7 +153,9 @@ export default async function (pi) {
             await unlink(operation.source);
           } else if (operation.destination) {
             await mkdir(dirname(operation.destination), { recursive: true });
-            await writeFile(operation.destination, operation.after, "utf8");
+            await writeFile(operation.destination, operation.after, { encoding: "utf8", flag: "wx", mode: operation.mode });
+            // Creation applies umask; restore the source's ordinary permission bits.
+            await chmod(operation.destination, operation.mode);
             await unlink(operation.source);
           } else {
             await writeFile(operation.source, operation.after, "utf8");

package/packages/codex-edit/tests/comparison-cases.mjs

@@ -1,4 +1,39 @@
 export const comparisonCases = [
+  ...[false, true].map((childFirst) => ({
+    id: childFirst ? "file-parent-conflict-reversed" : "file-parent-conflict",
+    kind: "safety",
+    executionOnly: true,
+    input: { "important.txt": "before\n" },
+    expected: null,
+    patch: `*** Begin Patch
+*** Update File: important.txt
+@@
+-before
++after
+${childFirst ? "*** Add File: parent/child.txt\n+child\n*** Add File: parent\n+file" : "*** Add File: parent\n+file\n*** Add File: parent/child.txt\n+child"}
+*** End Patch`,
+    nativeCalls: null,
+    // The frozen released baseline covers the parser, not filesystem preflight.
+    outcomes: { native: "unsupported", released: "unsupported", local: "fail" },
+  })),
+  {
+    id: "move-preserves-file-mode",
+    kind: "valid-edit",
+    executionOnly: true,
+    input: { "run.sh": "#!/bin/sh\necho old\n" },
+    inputModes: { "run.sh": 0o755 },
+    expected: { "moved.sh": "#!/bin/sh\necho new\n" },
+    expectedModes: { "moved.sh": 0o755 },
+    patch: `*** Begin Patch
+*** Update File: run.sh
+*** Move to: moved.sh
+@@
+-echo old
++echo new
+*** End Patch`,
+    nativeCalls: null,
+    outcomes: { native: "unsupported", released: "unsupported", local: "pass" },
+  },
   {
     id: "unique-replacement",
     kind: "valid-edit",

package/packages/codex-edit/tests/comparison-harness.mjs

@@ -30,15 +30,14 @@ export function applyOperations(input, operations, applyUpdate) {
 }
 
 export function runPatchCase(testCase, parse, applyUpdate, expectedOutcome) {
+  let actual;
   try {
-    const actual = applyOperations(testCase.input, parse(testCase.patch), applyUpdate);
-    if (expectedOutcome !== "pass") {
-      assert.fail(`${testCase.id}: expected ${expectedOutcome}, but patch succeeded`);
-    }
-    assert.deepEqual(actual, testCase.expected, `${testCase.id}: final filesystem differs`);
-    return "pass";
+    actual = applyOperations(testCase.input, parse(testCase.patch), applyUpdate);
   } catch (error) {
     if (expectedOutcome === "pass") throw error;
     return "fail";
   }
+  assert.equal(expectedOutcome, "pass", `${testCase.id}: patch unexpectedly succeeded`);
+  assert.deepEqual(actual, testCase.expected, `${testCase.id}: final filesystem differs`);
+  return "pass";
 }

package/packages/codex-edit/tests/generate-test-report.mjs

@@ -314,6 +314,8 @@ function buildMarkdown(results, benchmark) {
   const assessment = benchmarkAssessment(benchmark);
   const validCases = comparisonCases.filter((testCase) => testCase.outcomes.local === "pass");
   const safetyCases = comparisonCases.filter((testCase) => testCase.outcomes.local === "fail");
+  const parserValidCases = validCases.filter((testCase) => !testCase.executionOnly);
+  const parserSafetyCases = safetyCases.filter((testCase) => !testCase.executionOnly);
   const nativeValidPasses = validCases.filter((testCase) => testCase.outcomes.native === "pass").length;
   const nativeValidFailures = validCases.filter((testCase) => testCase.outcomes.native === "fail").length;
   const nativeValidUnsupported = validCases.filter((testCase) => testCase.outcomes.native === "unsupported").length;
@@ -331,6 +333,7 @@ function buildMarkdown(results, benchmark) {
     `被测包：\`@maxiaochao/pi-codex-edit\`（当前工作区）`,
     "",
     "本报告严格区分真实模型基准、确定性协议回归和安全回归，三类成功率不会混算。",
+    "Agent Benchmark 是已提交的历史运行证据，不代表本次文件系统修复重新运行了付费模型基准。",
     "",
     "## 执行摘要",
     "",
@@ -352,10 +355,10 @@ function buildMarkdown(results, benchmark) {
     `- Node 测试：预期 29 个，覆盖用户配置覆盖与校验、parser、matcher、路由、包契约、resolved-path 防护、发布版对比、分层调度和生产事故语料。`,
     `- 共享对比 corpus：${comparisonCases.length} 个 case。`,
     `- 原生 edit：${count("pass", "native")} 通过 / ${count("fail", "native")} 失败或正确拒绝 / ${count("unsupported", "native")} 不适用。`,
-    `- Codex Edit 发布版 v0.1.7：${count("pass", "released")} 通过 / ${count("fail", "released")} 失败或正确拒绝。`,
+    `- Codex Edit 发布版 v0.1.7：${count("pass", "released")} 通过 / ${count("fail", "released")} 失败或正确拒绝 / ${count("unsupported", "released")} 不适用。`,
     `- Codex Edit 本地版：${count("pass", "local")} 通过 / ${count("fail", "local")} 正确安全拒绝。`,
     "",
-    "“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示 Pi 原生 `edit` 无法用一次编辑协议调用表达该操作，不计为工具缺陷。",
+    "“正确拒绝”表示无效或陈旧操作被拒绝，且工作区没有变化。“不适用”表示原生 edit 无法表达该操作，或冻结的发布版 parser 基线不包含文件系统执行层；不计为工具缺陷。层级冲突与权限保留使用本地扩展和真实临时文件验证，不伪造发布版执行结果。",
     "",
     "## 安全回归",
     "",
@@ -373,7 +376,7 @@ function buildMarkdown(results, benchmark) {
     "",
     "## 确定性对比结论",
     "",
-    `每个测试臂运行同一组 ${comparisonCases.length} 个 case。对比 1 执行 ${comparisonCases.length * 2} 次工具调用（原生 + 本地）；对比 2 执行 ${comparisonCases.length * 2} 次 parser/执行评估（发布版 + 本地）。下表以 ${validCases.length} 个有效编辑任务为完成率分母；${safetyCases.length} 个故意无效或危险的 patch 单独计入安全检查。`,
+    `共享语料共 ${comparisonCases.length} 个 case。不适用的测试臂不执行。对比 1 验证本地扩展的 ${validCases.length} 个有效编辑和 ${safetyCases.length} 个安全 case；对比 2 只比较 parser 基线适用的 ${parserValidCases.length} 个有效编辑和 ${parserSafetyCases.length} 个安全 case。`,
     "",
     "### 1. Pi 原生 edit vs Codex Edit 本地版",
     "",
@@ -389,9 +392,9 @@ function buildMarkdown(results, benchmark) {
     "",
     "| 指标 | 发布版 v0.1.7 | 本地修改版 | 变化 |",
     "|---|---:|---:|---:|",
-    `| 有效任务完成 | ${releasedValidPasses}/${validCases.length} | ${localValidPasses}/${validCases.length} | +${localValidPasses - releasedValidPasses} 个 |`,
-    `| 有效任务完成率 | ${rate(releasedValidPasses, validCases.length)} | ${rate(localValidPasses, validCases.length)} | ${signedPoints(localValidPasses, releasedValidPasses, validCases.length)} |`,
-    `| 安全 case 正确拒绝 | ${releasedSafetyPasses}/${safetyCases.length} (${rate(releasedSafetyPasses, safetyCases.length)}) | ${localSafetyPasses}/${safetyCases.length} (${rate(localSafetyPasses, safetyCases.length)}) | 无变化 |`,
+    `| 有效任务完成 | ${releasedValidPasses}/${parserValidCases.length} | ${parserValidCases.length}/${parserValidCases.length} | +${parserValidCases.length - releasedValidPasses} 个 |`,
+    `| 有效任务完成率 | ${rate(releasedValidPasses, parserValidCases.length)} | 100.0% | ${signedPoints(parserValidCases.length, releasedValidPasses, parserValidCases.length)} |`,
+    `| 安全 case 正确拒绝 | ${releasedSafetyPasses}/${parserSafetyCases.length} (${rate(releasedSafetyPasses, parserSafetyCases.length)}) | ${parserSafetyCases.length}/${parserSafetyCases.length} (100.0%) | 无变化 |`,
     `| 保留原有通过任务 | ${releasedValidPasses}/${releasedValidPasses} | ${releasedValidPasses}/${releasedValidPasses} | 100% 保留 |`,
     "",
     "这些是确定性协议/执行成功率，不是独立模型采样成功率。Agent 质量、token、成本和耗时只在 Agent Benchmark 章节报告。",
@@ -424,7 +427,7 @@ function buildMarkdown(results, benchmark) {
     ...comparisonCases.map((testCase) => {
       const released = outcomeLabel(testCase.outcomes.released);
       const local = outcomeLabel(testCase.outcomes.local);
-      const status = testCase.outcomes.released === "fail" && testCase.outcomes.local === "pass"
+      const status = testCase.executionOnly ? "仅本地真实文件验证" : testCase.outcomes.released === "fail" && testCase.outcomes.local === "pass"
         ? "已修复"
         : "已保留";
       return `| \`${testCase.id}\` | ${released} | ${local} | ${status} |`;
@@ -440,6 +443,8 @@ function buildMarkdown(results, benchmark) {
     "| 同一 raw path 出现多个普通 `Update File` | 合并后按顺序执行 | `repeated-update-same-path` |",
     "| Add/delete/move 或 resolved path alias 冲突 | 写入前拒绝 | `conflicting-targets`、`resolved-path-alias-conflict` |",
     "| 工作区外绝对路径 | 读取或写入前正确拒绝 | `outside-workspace-absolute-path` |",
+    "| 文件与父目录层级冲突 | 任意操作写入前拒绝，两种顺序均零写入 | `file-parent-conflict`、`file-parent-conflict-reversed` |",
+    "| Move 丢失执行权限 | 保留源文件普通权限位，不受 umask 截断 | `move-preserves-file-mode` |",
     "| 空 update chunk | 拒绝，不猜测意图 | `empty-update-chunk` |",
     "| 陈旧预期行 | 拒绝；调用方必须重新读取并生成 patch | `stale-expected-lines` |",
     "| 缺少 `patch` 参数 | 必填 TypeBox schema 在扩展执行前拒绝 | 包契约测试 |",

package/packages/codex-edit/tests/native-vs-codex.ts

@@ -1,5 +1,5 @@
 import assert from "node:assert/strict";
-import { mkdtemp, mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";
+import { chmod, mkdtemp, mkdir, readFile, readdir, rm, stat, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { createEditToolDefinition } from "@earendil-works/pi-coding-agent";
@@ -37,15 +37,13 @@ async function runNativeCase(testCase) {
       for (const [index, call] of testCase.nativeCalls.entries()) {
         await edit.execute(`native-${index}`, call, undefined, undefined, { cwd: workspace });
       }
-      if (testCase.outcomes.native !== "pass") {
-        assert.fail(`${testCase.id}: native edit unexpectedly succeeded`);
-      }
-      assert.deepEqual(await readSnapshot(workspace), testCase.expected);
-      return "pass";
     } catch (error) {
       if (testCase.outcomes.native === "pass") throw error;
       return "fail";
     }
+    assert.equal(testCase.outcomes.native, "pass", `${testCase.id}: native edit unexpectedly succeeded`);
+    assert.deepEqual(await readSnapshot(workspace), testCase.expected);
+    return "pass";
   } finally {
     await rm(workspace, { recursive: true, force: true });
   }
@@ -66,16 +64,12 @@ async function runCodexCase(tool, testCase) {
   const workspace = await mkdtemp(join(tmpdir(), "codex-edit-local-"));
   try {
     await writeSnapshot(workspace, testCase.input);
+    for (const [path, mode] of Object.entries(testCase.inputModes ?? {})) await chmod(join(workspace, path), mode);
     try {
       await tool.execute("codex-local", { patch: testCase.patch }, undefined, undefined, {
         cwd: workspace,
         hasUI: false,
       });
-      if (testCase.outcomes.local !== "pass") {
-        assert.fail(`${testCase.id}: local Codex Edit unexpectedly succeeded`);
-      }
-      assert.deepEqual(await readSnapshot(workspace), testCase.expected);
-      return "pass";
     } catch (error) {
       if (testCase.outcomes.local === "pass") throw error;
       assert.deepEqual(
@@ -85,6 +79,12 @@ async function runCodexCase(tool, testCase) {
       );
       return "fail";
     }
+    assert.equal(testCase.outcomes.local, "pass", `${testCase.id}: local Codex Edit unexpectedly succeeded`);
+    assert.deepEqual(await readSnapshot(workspace), testCase.expected);
+    for (const [path, mode] of Object.entries(testCase.expectedModes ?? {})) {
+      assert.equal((await stat(join(workspace, path))).mode & 0o777, mode, `${testCase.id}: file permissions changed`);
+    }
+    return "pass";
   } finally {
     await rm(workspace, { recursive: true, force: true });
   }
@@ -101,9 +101,9 @@ export default async function () {
   assert.equal(results.length, comparisonCases.length);
   assert.equal(results.filter(({ native }) => native === "pass").length, 5);
   assert.equal(results.filter(({ native }) => native === "fail").length, 2);
-  assert.equal(results.filter(({ native }) => native === "unsupported").length, 5);
-  assert.equal(results.filter(({ codex }) => codex === "pass").length, 7);
-  assert.equal(results.filter(({ codex }) => codex === "fail").length, 5);
+  assert.equal(results.filter(({ native }) => native === "unsupported").length, 8);
+  assert.equal(results.filter(({ codex }) => codex === "pass").length, 8);
+  assert.equal(results.filter(({ codex }) => codex === "fail").length, 7);
   for (const result of results) console.log(`${result.id}: native=${result.native}, codex=${result.codex}`);
   console.log(`Native edit vs local Codex Edit: ${results.length} comparison cases passed`);
 }

package/packages/codex-edit/tests/released-vs-local.test.mjs

@@ -8,6 +8,10 @@ import { applyLegacyUpdate, parseLegacyPatch } from "./legacy-parser-v0.1.7.mjs"
 test("released v0.1.7 versus local parser over the growing comparison corpus", () => {
   const results = [];
   for (const testCase of comparisonCases) {
+    if (testCase.executionOnly) {
+      results.push({ id: testCase.id, released: "unsupported", local: "unsupported" });
+      continue; // Verified with real files by native-vs-codex.ts, not by a parser-only baseline.
+    }
     const released = runPatchCase(
       testCase,
       parseLegacyPatch,