pi-codex-tools 0.2.0 → 0.2.2

package/CHANGELOG.md

@@ -6,6 +6,22 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.2.2] - 2026-08-10
+
+### Changed
+
+- Keep provider-side parallel tool calls enabled while preserving sequential `apply_patch` execution.
+
+### Fixed
+
+- Strip untrusted terminal control sequences from `apply_patch` previews before rendering them in the Pi TUI.
+
+## [0.2.1] - 2026-08-08
+
+### Fixed
+
+- Stop npm from running `node-gyp rebuild` on install. The package ships prebuilt native bindings and loads them at runtime, but npm's gypfile detection keyed off the dev-only `binding.gyp` and injected a failing `node-gyp rebuild` into the install lifecycle — breaking install on machines without a build toolchain (e.g. Linux). Set `gypfile: false` to suppress it.
+
 ## [0.2.0] - 2026-08-08
 
 ### Added

package/README.md

@@ -8,7 +8,7 @@ Give grammar-capable OpenAI/Codex models the Codex `apply_patch` tool in Pi with
 - **Capability-based activation** — requires `openai-codex-responses` or `openai-responses` plus `model.compat.supportsOpenAIGrammarTools === true`; model names alone are never enough.
 - **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, stay under Pi's current working directory, reject symlink escapes, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
 - **Model switching** — supported models replace Pi's `edit` and `write` tools with `apply_patch`; other active tools are preserved. Switching back restores only the file tools that were active before the switch.
-- **Sequential patch calls** — the extension marks patch execution sequential and disables provider-side parallel tool calls when the patch tool is active.
+- **Sequential patch calls** — the extension marks patch execution sequential while leaving provider-side parallel tool calls enabled.
 - **Streaming progress** — while a patch is generated, the TUI shows a live, color-coded glimpse of the content being written (new-file content, or `+`/`-` lines for updates) plus a running `+added -removed` tally and a per-file roster for multi-file patches. It reuses Pi's shared diff rendering and mirrors the built-in `write`/`edit` previews; patch execution is unchanged.
 
 ## Installation

package/SECURITY.md

@@ -21,6 +21,6 @@ Pi extensions execute with the same permissions as the local user running Pi. Re
 
 `apply_patch` does not access the network or credential APIs. It can read credential-containing files when a patch targets them. It validates paths beneath the current working directory, rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot escape. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for `darwin-arm64` and `darwin-x64`, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those three POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
 
-The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
+The package strips untrusted C0/C1 control bytes and terminal escape sequences from `apply_patch` preview text and paths before handing them to the TUI. The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
 
 Install/update telemetry is best effort and can be disabled with `PI_OFFLINE=1`, `PI_TELEMETRY=0`, `PI_TELEMETRY=false`, CI detection, or Pi's `enableInstallTelemetry: false` setting. Through `@mocito/install-telemetry`, it sends the package name and version as HTTPS URL query parameters and adds `process.platform`, the runtime name/version, and `process.arch` to the `User-Agent`. These fields are not intended to identify a host, user, repository, or path; no prompts, patches, file contents, credentials, auth headers, or provider responses are sent.

package/extensions/index.ts

@@ -122,15 +122,4 @@ export default function piCodexTools(pi: ExtensionAPI): void {
   pi.on("model_select", (_event, ctx) => {
     synchronizeTools(ctx);
   });
-
-  pi.on("before_provider_request", (event, ctx) => {
-    if (!supportsOpenAIGrammarTools(ctx.model)) return;
-    if (typeof pi.getActiveTools !== "function" || !pi.getActiveTools().includes(APPLY_PATCH)) return;
-    if (!isRecord(event.payload) || event.payload.parallel_tool_calls !== true) return;
-    return { ...event.payload, parallel_tool_calls: false };
-  });
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-tools",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Codex-compatible apply_patch tooling for Pi's grammar-capable OpenAI models.",
   "type": "module",
   "license": "Apache-2.0",
@@ -60,13 +60,13 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.82.1",
-    "@earendil-works/pi-coding-agent": "^0.82.1",
-    "@earendil-works/pi-tui": "^0.82.1",
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@earendil-works/pi-tui": "^0.84.1",
     "@types/node": "^26.1.2",
     "prebuildify": "^6.0.1",
-    "tsx": "^4.23.1",
-    "typebox": "^1.3.8",
+    "tsx": "^4.23.5",
+    "typebox": "^1.3.10",
     "typescript": "^7.0.2"
   },
   "publishConfig": {
@@ -78,5 +78,6 @@
   "dependencies": {
     "@mocito/install-telemetry": "0.1.1",
     "node-gyp-build": "^4.8.4"
-  }
+  },
+  "gypfile": false
 }

package/src/patch-preview.ts

@@ -5,6 +5,7 @@
 // (it never throws) to drive a live, write-style glimpse of the content plus a running
 // added/removed tally. It reuses Pi's shared `renderDiff` primitive for +/- coloring, so the
 // preview stays consistent with the built-in `edit` tool's diff preview.
+import { stripTerminalSequences } from "@earendil-works/pi-tui";
 import { keyHint, type Theme } from "@earendil-works/pi-coding-agent";
 
 const FILE_ADD = "*** Add File: ";
@@ -26,6 +27,11 @@ const MAX_PREVIEW_BYTES = 256 * 1024;
 const MAX_PREVIEW_FILES = 500;
 /** Cap a single rendered glimpse line so minified/generated content cannot flood the TUI. */
 const PREVIEW_LINE_CHARS = 200;
+const TERMINAL_CONTROL_CHARS = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;
+
+function sanitizeTerminalText(text: string): string {
+  return stripTerminalSequences(text).replace(TERMINAL_CONTROL_CHARS, "").replace(/\t/g, "   ");
+}
 
 export type PatchLineType = "add" | "del" | "ctx";
 
@@ -156,8 +162,10 @@ function fileMarkLabel(file: PatchPreviewFile, theme: Theme): string {
 }
 
 function filePathLabel(file: PatchPreviewFile, theme: Theme): string {
-  const path = theme.fg("accent", truncatePath(file.path));
-  return file.moveTo ? `${path} ${theme.fg("muted", "->")} ${theme.fg("accent", truncatePath(file.moveTo))}` : path;
+  const path = theme.fg("accent", truncatePath(sanitizeTerminalText(file.path)));
+  return file.moveTo
+    ? `${path} ${theme.fg("muted", "->")} ${theme.fg("accent", truncatePath(sanitizeTerminalText(file.moveTo)))}`
+    : path;
 }
 
 function formatFileRosterLine(file: PatchPreviewFile, theme: Theme): string {
@@ -177,7 +185,8 @@ function countLines(file: PatchPreviewFile, type: PatchLineType): number {
  */
 function renderGlimpseLine(line: PatchPreviewLine, theme: Theme): string {
   const sign = line.type === "add" ? "+" : line.type === "del" ? "-" : " ";
-  const body = line.text.length > PREVIEW_LINE_CHARS ? `${line.text.slice(0, PREVIEW_LINE_CHARS)}…` : line.text;
+  const text = sanitizeTerminalText(line.text);
+  const body = text.length > PREVIEW_LINE_CHARS ? `${text.slice(0, PREVIEW_LINE_CHARS)}…` : text;
   const styled = `${sign}${body}`;
   if (line.type === "add") return theme.fg("toolDiffAdded", styled);
   if (line.type === "del") return theme.fg("toolDiffRemoved", styled);
@@ -263,5 +272,5 @@ export function formatApplyPatchResultText(
     .map((part) => part.text ?? "")
     .join("\n")
     .trim();
-  return output ? theme.fg("error", output) : undefined;
+  return output ? theme.fg("error", sanitizeTerminalText(output)) : undefined;
 }