@thegitai/cli 1.0.0-beta.11 → 1.0.0-beta.13

package/dist/src/artifact-policy.js

@@ -148,12 +148,18 @@ export const ARTIFACT_FALLBACK_IGNORE_GLOBS = [
     '**/pnpm-lock.yaml',
     ...ARTIFACT_IGNORE_PATH_PREFIXES.map((prefix) => `${prefix}/**`),
 ];
+// Kept in lockstep with the server's secret-path check: the client repair guard
+// and the server-side secret check must agree on what counts as a secret, or a
+// quoted/curly secret path the client repairs (e.g. service-account.json) slips
+// past the server check, which keys off the original tool-call args.
 const SENSITIVE_BASENAME_PATTERNS = [
     /^\.env(?:\..+)?$/i,
     /^\.?npmrc$/i,
     /^\.?pypirc$/i,
     /^credentials(?:\..*)?$/i,
     /^secrets?(?:\..*)?$/i,
+    /^service[-_]?account(?:\..*)?\.json$/i,
+    /^.*credentials.*\.json$/i,
 ];
 const SENSITIVE_PATH_PATTERNS = [
     /(^|[/\\])\.aws[/\\]credentials$/i,
@@ -161,6 +167,7 @@ const SENSITIVE_PATH_PATTERNS = [
     /(^|[/\\])credentials?([._-]|$)/i,
     /(^|[/\\])secrets?([._-]|$)/i,
     /(^|[/\\])private[-_]?key([._-]|$)/i,
+    /(^|[/\\])service[-_]?account/i,
     /\.(?:pem|key|p12|pfx)$/i,
 ];
 export function normalizeArtifactPath(relPath) {

package/dist/src/tool-executor.js

@@ -2,6 +2,7 @@ import { canStoreEditSnapshot, isEditToolName, isGitWorkTree, MAX_EDIT_JOURNAL_R
 import { clearEditFailure, collectCommandMutations, captureMutationBaseline, ensureActiveCheckpoint, recordEditFailure, recordSessionEdit, rememberCheckpointFiles, } from './session-safety.js';
 import { buildAgentModeToolBlockedResult, } from './agent-mode.js';
 import { dispatchTool } from './tools/index.js';
+import { PATH_REPAIRING_EDIT_TOOLS, repairFilePath } from './tools/path-suggest.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './tools/shell-diagnostics.js';
 const EDIT_FILE_PATH_ARG_ALIASES = [
     'filePath',
@@ -45,6 +46,17 @@ function getEditToolFilePath(call) {
     }
     return '';
 }
+// replace_document_text repairs its source filePath but writes a separate
+// outputPath verbatim (a write target must not be fold-matched onto a different
+// existing file). When an outputPath is given, the snapshot path it returns is
+// that raw output, so it must not be repaired.
+function editToolWritesSeparateOutput(call) {
+    if (call.name !== 'replace_document_text')
+        return false;
+    const args = call.args && typeof call.args === 'object' ? call.args : {};
+    const output = args.outputPath ?? args.output_path;
+    return typeof output === 'string' && output.trim().length > 0;
+}
 function recordAssistantEdit(session, call, result, before) {
     if (!before || !isEditToolName(call.name))
         return;
@@ -119,7 +131,21 @@ export async function executeLocalToolCall(toolContext, session, call) {
             session.onToolEvent?.({ call, result });
             return result;
         }
-        const filePathBeforeEdit = isEditToolName(call.name) ? getEditToolFilePath(call) : '';
+        // Snapshot the real file the edit tool will touch. Tools that repair their
+        // path internally (str_replace/patch_file/replace_document_text) must be
+        // snapshotted against the repaired path, or the pre-edit snapshot targets
+        // the unrepaired path and the edit is journaled as a `create` and undone by
+        // deleting the user's file. write_file/delete_file consume the raw path, so
+        // repairing their snapshot would instead journal a phantom edit of a
+        // different file — keep them on the raw path.
+        const rawEditFilePath = isEditToolName(call.name)
+            ? getEditToolFilePath(call)
+            : '';
+        const filePathBeforeEdit = rawEditFilePath &&
+            PATH_REPAIRING_EDIT_TOOLS.has(call.name) &&
+            !editToolWritesSeparateOutput(call)
+            ? repairFilePath(session.rootDir, rawEditFilePath)
+            : rawEditFilePath;
         if (filePathBeforeEdit) {
             rememberCheckpointFiles(session.clientState.safety, session.rootDir, [filePathBeforeEdit], session.turnState.id);
         }

package/dist/src/tools/patch-file.js

@@ -3,13 +3,14 @@ import path from 'node:path';
 import { normalizeProjectRelativePath } from '../artifact-policy.js';
 import { applyUnifiedPatch, readProjectFile, renderDiffPreview, writeProjectFile, } from '../patcher.js';
 import { upsertIndexFile } from '../project-index.js';
+import { repairFilePath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, resolveRedactionTokens } from '../session-safety.js';
 import { invalidateShellDiagnosticsCache, runShellDiagnostics, } from './shell-diagnostics.js';
 const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
 export async function patchFile(context, args) {
     const { rootDir, projectIndex, autoYes, confirmPatch } = context;
-    const filePath = String(args.filePath ?? '').trim();
+    const filePath = repairFilePath(rootDir, String(args.filePath ?? '').trim());
     let patch = typeof args.patch === 'string' ? args.patch : '';
     if (!filePath) {
         return { ok: false, error: 'filePath is required' };

package/dist/src/tools/path-suggest.js

@@ -1,6 +1,6 @@
-import { readdirSync } from 'node:fs';
+import { existsSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import { isSensitiveProjectPath } from '../artifact-policy.js';
+import { isSensitiveProjectPath, shouldIgnoreArtifactPath, } from '../artifact-policy.js';
 // "File not found" recovery hint: when a model mistypes a filename (most
 // often Unicode punctuation — a straight ' for a curly ’ — or a small typo),
 // suggest the closest real file from the same directory.
@@ -64,3 +64,113 @@ export function suggestClosestPath(rootDir, missingPath) {
     const relative = path.relative(rootDir, suggested);
     return relative && !relative.startsWith('..') ? relative : suggested;
 }
+// Fold only the punctuation/whitespace a model routinely alters when it echoes
+// a filename — a curly apostrophe ’ flattened to a straight ', smart double
+// quotes, and a non-breaking space — WITHOUT touching case, so a path is only
+// auto-corrected when nothing but this punctuation differs from a real file.
+function foldPunctuation(name) {
+    return name
+        .normalize('NFC')
+        .replace(/[‘’ʼ]/g, "'")
+        .replace(/[“”]/g, '"')
+        .replace(/ /g, ' ');
+}
+// Strip ONE matched pair of surrounding quotes. A path pasted from a file
+// manager's "Copy as path" or dragged into a terminal arrives wrapped in
+// '…' / "…", and that wrapping is captured verbatim as part of the filename.
+function stripSurroundingQuotes(p) {
+    if (p.length >= 2) {
+        const first = p[0];
+        const last = p[p.length - 1];
+        if ((first === "'" && last === "'") || (first === '"' && last === '"')) {
+            return p.slice(1, -1);
+        }
+    }
+    return p;
+}
+// A single backslash is a legal filename byte on POSIX, but models routinely
+// double it (it is JSON's escape character) when echoing a name, turning
+// `back\slash.js` into `back\\slash.js`. Collapse doubled backslashes to one.
+function collapseDoubledBackslashes(p) {
+    return p.replace(/\\\\/g, '\\');
+}
+function resolveAgainst(rootDir, p) {
+    return path.isAbsolute(p) ? p : path.resolve(rootDir, p);
+}
+function existsAgainst(rootDir, p) {
+    try {
+        return existsSync(resolveAgainst(rootDir, p));
+    }
+    catch {
+        return false;
+    }
+}
+// Repair must never resolve a protected file (a secret like `.env`/credentials).
+// Repair only runs when the literal path is missing, so without this a quoted or
+// curly-flattened secret path — which used to fail as not-found — would be
+// silently resolved to the real secret, bypassing the redaction that keys off
+// the original tool-call args (e.g. read_document, str_replace, patch_file).
+function isProtectedRepairTarget(rootDir, candidate) {
+    const rel = path.relative(rootDir, resolveAgainst(rootDir, candidate));
+    const projectPath = rel && !rel.startsWith('..') ? rel : candidate;
+    return (isSensitiveProjectPath(projectPath) ||
+        (rel !== '' && !rel.startsWith('..') && shouldIgnoreArtifactPath(rel)));
+}
+// Edit tools that call repairFilePath on their path argument internally. The
+// executor repairs the pre-edit snapshot path only for these, so its snapshot
+// targets the same file the tool writes; write_file/delete_file consume the raw
+// path, so their snapshot must too.
+export const PATH_REPAIRING_EDIT_TOOLS = new Set([
+    'str_replace',
+    'patch_file',
+    'replace_document_text',
+]);
+// Repair a model/user-supplied path to a real on-disk file WITHOUT changing
+// intent, for tools that act on a file expected to already exist. Literal
+// first: any path that already resolves — including one that legitimately
+// contains quotes or backslashes — is returned untouched. Only when the path
+// does not resolve do we try safe de-manglings: strip surrounding quotes,
+// collapse doubled backslashes, and finally match a directory entry that
+// differs only by foldable punctuation (the "model flattened a curly ’ to a
+// straight '" case, which no transform of the input can reproduce). Returns the
+// input unchanged when nothing better exists, so the caller's normal not-found
+// handling (and its recovery hint) still fires.
+export function repairFilePath(rootDir, raw) {
+    if (!raw || existsAgainst(rootDir, raw))
+        return raw;
+    const dequoted = stripSurroundingQuotes(raw);
+    for (const candidate of [
+        dequoted,
+        collapseDoubledBackslashes(raw),
+        collapseDoubledBackslashes(dequoted),
+    ]) {
+        if (candidate !== raw &&
+            existsAgainst(rootDir, candidate) &&
+            !isProtectedRepairTarget(rootDir, candidate)) {
+            return candidate;
+        }
+    }
+    const probe = resolveAgainst(rootDir, dequoted);
+    const directory = path.dirname(probe);
+    const wanted = foldPunctuation(path.basename(probe));
+    if (!wanted)
+        return raw;
+    let entries;
+    try {
+        entries = readdirSync(directory);
+    }
+    catch {
+        return raw;
+    }
+    const matches = entries.filter((entry) => foldPunctuation(entry) === wanted);
+    if (matches.length !== 1)
+        return raw; // none, or ambiguous — never guess
+    const matchedAbs = path.join(directory, matches[0]);
+    const matchedRel = path.relative(rootDir, matchedAbs);
+    const matched = path.isAbsolute(dequoted) ? matchedAbs : matchedRel || matchedAbs;
+    // Never auto-resolve into a protected file: a fold-match that lands on `.env`
+    // would confirm its existence to the model and bypass redaction.
+    if (isProtectedRepairTarget(rootDir, matched))
+        return raw;
+    return matched;
+}

package/dist/src/tools/read-document.js

@@ -1,7 +1,7 @@
 import path from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
 import { isSensitiveProjectPath, normalizeProjectRelativePath, } from '../artifact-policy.js';
-import { suggestClosestPath } from './path-suggest.js';
+import { repairFilePath, suggestClosestPath } from './path-suggest.js';
 import { readCliAuthConfig } from '../api/auth.js';
 export function normalizeDocumentText(raw) {
     const text = String(raw ?? '').replace(/\r\n?/g, '\n');
@@ -71,7 +71,7 @@ async function parseDocumentOnServer(config, fileName, fileData, ext, args) {
     return data;
 }
 export async function readDocument(rootDir, args, env) {
-    const raw = String(args.filePath ?? '').trim();
+    const raw = repairFilePath(rootDir, String(args.filePath ?? '').trim());
     if (!raw) {
         return { ok: false, error: 'filePath is required' };
     }

package/dist/src/tools/read-file.js

@@ -3,6 +3,7 @@ import path from 'path';
 import { normalizeProjectRelativePath, shouldIgnoreArtifactPath, } from '../artifact-policy.js';
 import { buildSecretFilePreview, isDotenvLikePath, looksLikeEditableDotenv, shouldUseSecretFilePreview, } from '../secret-preview.js';
 import { readProjectFile } from '../patcher.js';
+import { repairFilePath } from './path-suggest.js';
 import { dotenvFitsRedactionBudget, getCurrentFileHash, recordReadCoverage, redactContentWithStableTokens, redactDotenvWithStableTokens, } from '../session-safety.js';
 import { readFileRange, truncate } from '../utils.js';
 const MAX_FILE_READ_CHARS = 12000;
@@ -10,7 +11,7 @@ const DOCUMENT_EXTENSIONS = new Set(['.pdf', '.xlsx', '.docx']);
 export async function readFile(context, args) {
     const rootDir = typeof context === 'string' ? context : context.rootDir;
     const safety = typeof context === 'string' ? undefined : context.safety;
-    const filePath = String(args.filePath ?? '').trim();
+    const filePath = repairFilePath(rootDir, String(args.filePath ?? '').trim());
     if (!filePath) {
         return { ok: false, error: 'filePath is required' };
     }
@@ -41,13 +42,23 @@ export async function readFile(context, args) {
             content = readProjectFile(rootDir, filePath);
         }
         catch (err) {
-            return { ok: false, error: err.message };
+            const message = String(err?.message ?? err);
+            const notFound = /^File does not exist:/.test(message);
+            return {
+                ok: false,
+                error: message,
+                ...(notFound ? { failureCategory: 'not_found' } : {}),
+            };
         }
     }
     else {
         const absPath = path.resolve(filePath);
         if (!existsSync(absPath)) {
-            return { ok: false, error: `File does not exist: ${filePath}` };
+            return {
+                ok: false,
+                error: `File does not exist: ${filePath}`,
+                failureCategory: 'not_found',
+            };
         }
         try {
             content = readFileSync(absPath, 'utf-8');

package/dist/src/tools/replace-document-text.js

@@ -4,7 +4,7 @@ import path from 'node:path';
 import { isSensitiveProjectPath, normalizeProjectRelativePath, } from '../artifact-policy.js';
 import { readCliAuthConfig } from '../api/auth.js';
 import { resolveProjectPath, writeProjectFileBuffer } from '../patcher.js';
-import { suggestClosestPath } from './path-suggest.js';
+import { repairFilePath, suggestClosestPath } from './path-suggest.js';
 import { isTuiMode } from '../runtime-mode.js';
 function normalizeReplacements(value) {
     if (!Array.isArray(value))
@@ -76,7 +76,7 @@ async function replaceDocumentTextOnServer(config, fileName, fileData, replaceme
     return data;
 }
 export async function replaceDocumentText(context, args) {
-    const sourceRaw = String(args.filePath ?? args.file_path ?? '').trim();
+    const sourceRaw = repairFilePath(context.rootDir, String(args.filePath ?? args.file_path ?? '').trim());
     if (!sourceRaw) {
         return { ok: false, error: 'filePath is required' };
     }
@@ -95,6 +95,10 @@ export async function replaceDocumentText(context, args) {
             failureCategory: 'invalid_argument',
         };
     }
+    // outputPath is a write target, not an existing input, so it must NOT be
+    // path-repaired: fold-match could redirect a "create Review '24.docx" onto an
+    // existing Review ’24.docx and overwrite it. The executor mirrors this by not
+    // repairing the snapshot path when an outputPath is present.
     const outputRaw = String(args.outputPath ?? args.output_path ?? '').trim();
     const targetPath = outputRaw
         ? relativeEditablePath(context.rootDir, outputRaw)

package/dist/src/tools/str-replace.js

@@ -2,6 +2,7 @@ import chalk from '../colors.js';
 import path from 'node:path';
 import { normalizeProjectRelativePath } from '../artifact-policy.js';
 import { readProjectFile, writeProjectFile } from '../patcher.js';
+import { repairFilePath } from './path-suggest.js';
 import { upsertIndexFile } from '../project-index.js';
 import { isTuiMode } from '../runtime-mode.js';
 import { getCurrentFileHash, resolveRedactionTokens } from '../session-safety.js';
@@ -76,7 +77,7 @@ function buildStrReplacePreview(oldString, newString) {
 }
 export async function strReplace(context, args) {
     const { rootDir, projectIndex, autoYes, confirmPatch } = context;
-    const filePath = String(args.filePath ?? args.file_path ?? '').trim();
+    const filePath = repairFilePath(rootDir, String(args.filePath ?? args.file_path ?? '').trim());
     let oldString = typeof args.old_string === 'string'
         ? args.old_string
         : typeof args.oldString === 'string'

package/dist/src/ui/repl.js

@@ -997,7 +997,12 @@ export function getInputCommandToken(input) {
     if (!trimmed.startsWith('/'))
         return '';
     const firstSpaceIndex = trimmed.indexOf(' ');
-    return firstSpaceIndex === -1 ? trimmed : trimmed.slice(0, firstSpaceIndex);
+    const token = firstSpaceIndex === -1 ? trimmed : trimmed.slice(0, firstSpaceIndex);
+    // A token with a second '/' is a filesystem path (e.g. /home/user/repo),
+    // not a slash command — no command contains a slash, so don't treat it as one.
+    if (token.indexOf('/', 1) !== -1)
+        return '';
+    return token;
 }
 function shouldShowCommandPalette(state) {
     const trimmed = String(state.input ?? '').trim();
@@ -1006,7 +1011,11 @@ function shouldShowCommandPalette(state) {
         !state.modelPickerOpen &&
         !state.resumePickerOpen &&
         trimmed.startsWith('/') &&
-        !trimmed.includes(' '));
+        !trimmed.includes(' ') &&
+        // A '/'-prefixed token with a second '/' is a filesystem path, not a
+        // command — getInputCommandToken returns '' for it, so the palette stays
+        // closed when a folder path is pasted.
+        getInputCommandToken(trimmed) !== '');
 }
 export function shouldRemountLiveFrameForComposerInputChange(current, nextInput) {
     const currentShowsCommands = shouldShowCommandPalette(current);

package/dist/src/ui/tui/build-frame.js

@@ -177,7 +177,12 @@ function buildModelPickerOptions(currentModelId, serverModels) {
 function getInputCommandToken(input) {
     const trimmed = String(input ?? '').trimStart();
     const match = trimmed.match(/^\/[^\s]*/);
-    return match?.[0] ?? '';
+    const token = match?.[0] ?? '';
+    // A token with a second '/' is a filesystem path (e.g. /home/user/repo),
+    // not a slash command — no command contains a slash, so don't treat it as one.
+    if (token.indexOf('/', 1) !== -1)
+        return '';
+    return token;
 }
 function scoreSlashCommand(option, token) {
     if (option.command === token)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@thegitai/cli",
-  "version": "1.0.0-beta.11",
+  "version": "1.0.0-beta.13",
   "description": "TheGitAI CLI client (source-visible, proprietary)",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://thegit.ai",
@@ -25,10 +25,10 @@
     "@lydell/node-pty-linux-x64": "1.1.0",
     "@lydell/node-pty-win32-arm64": "1.1.0",
     "@lydell/node-pty-win32-x64": "1.1.0",
-    "@thegitai/tui-darwin-arm64": "1.0.0-beta.11",
-    "@thegitai/tui-darwin-x64": "1.0.0-beta.11",
-    "@thegitai/tui-linux-x64": "1.0.0-beta.11",
-    "@thegitai/tui-win32-x64": "1.0.0-beta.11",
+    "@thegitai/tui-darwin-arm64": "1.0.0-beta.13",
+    "@thegitai/tui-darwin-x64": "1.0.0-beta.13",
+    "@thegitai/tui-linux-x64": "1.0.0-beta.13",
+    "@thegitai/tui-win32-x64": "1.0.0-beta.13",
     "@vscode/ripgrep": "1.18.0"
   },
   "publishConfig": {