pi-codex-tools 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -6,6 +6,22 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.2.3] - 2026-08-11
+
+### Changed
+
+- Accept relative paths outside the current working directory and absolute paths, matching Pi's native `edit` and `write` tools while preserving no-follow filesystem operations.
+
+## [0.2.2] - 2026-08-10
+
+### Changed
+
+- Keep provider-side parallel tool calls enabled while preserving sequential `apply_patch` execution.
+
+### Fixed
+
+- Strip untrusted terminal control sequences from `apply_patch` previews before rendering them in the Pi TUI.
+
 ## [0.2.1] - 2026-08-08
 
 ### Fixed

package/README.md

@@ -6,9 +6,9 @@ Give grammar-capable OpenAI/Codex models the Codex `apply_patch` tool in Pi with
 
 - **Raw `apply_patch`** — sends Codex's Lark grammar as an OpenAI custom tool, so patches are not JSON-wrapped.
 - **Capability-based activation** — requires `openai-codex-responses` or `openai-responses` plus `model.compat.supportsOpenAIGrammarTools === true`; model names alone are never enough.
-- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, stay under Pi's current working directory, reject symlink escapes, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
+- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, accept relative or absolute paths like Pi's native file tools, reject symlink paths, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
 - **Model switching** — supported models replace Pi's `edit` and `write` tools with `apply_patch`; other active tools are preserved. Switching back restores only the file tools that were active before the switch.
-- **Sequential patch calls** — the extension marks patch execution sequential and disables provider-side parallel tool calls when the patch tool is active.
+- **Sequential patch calls** — the extension marks patch execution sequential while leaving provider-side parallel tool calls enabled.
 - **Streaming progress** — while a patch is generated, the TUI shows a live, color-coded glimpse of the content being written (new-file content, or `+`/`-` lines for updates) plus a running `+added -removed` tally and a per-file roster for multi-file patches. It reuses Pi's shared diff rendering and mirrors the built-in `write`/`edit` previews; patch execution is unchanged.
 
 ## Installation

package/SECURITY.md

@@ -19,8 +19,8 @@ Report privately through [GitHub Security Advisories](https://github.com/jvm/pi-
 
 Pi extensions execute with the same permissions as the local user running Pi. Review installed extensions and only install packages from sources you trust.
 
-`apply_patch` does not access the network or credential APIs. It can read credential-containing files when a patch targets them. It validates paths beneath the current working directory, rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot escape. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for `darwin-arm64` and `darwin-x64`, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those three POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
+`apply_patch` does not access the network or credential APIs. Like Pi's native `edit` and `write` tools, it accepts relative or absolute paths and can modify files outside the current working directory with the local user's permissions. It can read credential-containing files when a patch targets them. It rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a filesystem-root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot redirect a mutation. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for Apple silicon and Intel, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
 
-The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
+The package strips untrusted C0/C1 control bytes and terminal escape sequences from `apply_patch` preview text and paths before handing them to the TUI. The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
 
 Install/update telemetry is best effort and can be disabled with `PI_OFFLINE=1`, `PI_TELEMETRY=0`, `PI_TELEMETRY=false`, CI detection, or Pi's `enableInstallTelemetry: false` setting. Through `@mocito/install-telemetry`, it sends the package name and version as HTTPS URL query parameters and adds `process.platform`, the runtime name/version, and `process.arch` to the `User-Agent`. These fields are not intended to identify a host, user, repository, or path; no prompts, patches, file contents, credentials, auth headers, or provider responses are sent.

package/extensions/index.ts

@@ -44,7 +44,7 @@ export default function piCodexTools(pi: ExtensionAPI): void {
     promptGuidelines: [
       "Use apply_patch for file changes when it is available.",
       "Send the patch body directly; do not wrap it in JSON or add a shell heredoc.",
-      `Patch paths must stay inside the current working directory and patches are limited to ${MAX_PATCH_BYTES} bytes.`,
+      `Patch paths may be relative to the current working directory or absolute, and patches are limited to ${MAX_PATCH_BYTES} bytes.`,
     ],
     parameters: APPLY_PATCH_PARAMETERS,
     constrainedSampling: createOpenAILarkSampling(APPLY_PATCH_GRAMMAR),
@@ -122,15 +122,4 @@ export default function piCodexTools(pi: ExtensionAPI): void {
   pi.on("model_select", (_event, ctx) => {
     synchronizeTools(ctx);
   });
-
-  pi.on("before_provider_request", (event, ctx) => {
-    if (!supportsOpenAIGrammarTools(ctx.model)) return;
-    if (typeof pi.getActiveTools !== "function" || !pi.getActiveTools().includes(APPLY_PATCH)) return;
-    if (!isRecord(event.payload) || event.payload.parallel_tool_calls !== true) return;
-    return { ...event.payload, parallel_tool_calls: false };
-  });
-}
-
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-tools",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "Codex-compatible apply_patch tooling for Pi's grammar-capable OpenAI models.",
   "type": "module",
   "license": "Apache-2.0",
@@ -45,7 +45,6 @@
     "CONTRIBUTING.md",
     "CODE_OF_CONDUCT.md"
   ],
-  "gypfile": false,
   "scripts": {
     "check": "tsc --noEmit",
     "typecheck": "tsc --noEmit",
@@ -61,13 +60,13 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.82.1",
-    "@earendil-works/pi-coding-agent": "^0.82.1",
-    "@earendil-works/pi-tui": "^0.82.1",
+    "@earendil-works/pi-ai": "^0.84.1",
+    "@earendil-works/pi-coding-agent": "^0.84.1",
+    "@earendil-works/pi-tui": "^0.84.1",
     "@types/node": "^26.1.2",
     "prebuildify": "^6.0.1",
-    "tsx": "^4.23.1",
-    "typebox": "^1.3.8",
+    "tsx": "^4.23.5",
+    "typebox": "^1.3.10",
     "typescript": "^7.0.2"
   },
   "publishConfig": {
@@ -79,5 +78,6 @@
   "dependencies": {
     "@mocito/install-telemetry": "0.1.1",
     "node-gyp-build": "^4.8.4"
-  }
+  },
+  "gypfile": false
 }

package/src/apply-patch.ts

@@ -298,17 +298,18 @@ type VirtualFile = Omit<SafePath, "absolute"> & { content?: string };
 export async function applyPatch(input: string, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
   requireSecureFilesystem();
   const hunks = parseApplyPatch(input);
-  const root = await realpath(resolve(options.cwd));
+  const cwd = await realpath(resolve(options.cwd));
+  const root = sep;
   const lockPaths = hunks.flatMap((hunk) => {
-    const paths = [resolvePatchPath(hunk.path, root)];
-    if (hunk.kind === "update" && hunk.moveTo) paths.push(resolvePatchPath(hunk.moveTo, root));
+    const paths = [resolvePatchPath(hunk.path, cwd)];
+    if (hunk.kind === "update" && hunk.moveTo) paths.push(resolvePatchPath(hunk.moveTo, cwd));
     return paths;
   });
 
   return withMutationLocks(lockPaths, async () => {
     const rootFd = await openSecureRoot(root, options.signal);
     try {
-      const operations = await planOperations(hunks, root, rootFd, options.signal);
+      const operations = await planOperations(hunks, cwd, root, rootFd, options.signal);
       throwIfAborted(options.signal);
       // ponytail: preflight catches parse/match errors before writes; cross-process failures can still leave a partial multi-file patch.
       for (const operation of operations) {
@@ -338,15 +339,21 @@ export async function applyPatch(input: string, options: ApplyPatchOptions): Pro
   });
 }
 
-async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: number, signal?: AbortSignal): Promise<PlannedOperation[]> {
+async function planOperations(
+  hunks: ApplyPatchHunk[],
+  cwd: string,
+  root: string,
+  rootFd: number,
+  signal?: AbortSignal,
+): Promise<PlannedOperation[]> {
   const operations: PlannedOperation[] = [];
   const virtualFiles = new Map<string, VirtualFile>();
 
   const getVirtualFile = async (rawPath: string): Promise<{ absolute: string; file: VirtualFile }> => {
-    const absolute = resolvePatchPath(rawPath, root);
+    const absolute = resolvePatchPath(rawPath, cwd);
     const existing = virtualFiles.get(absolute);
     if (existing) return { absolute, file: existing };
-    const safe = await safePath(rawPath, root, signal);
+    const safe = await safePath(rawPath, cwd, signal);
     const file: VirtualFile = {
       exists: safe.exists,
       isDirectory: safe.isDirectory,
@@ -377,7 +384,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "add",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         content: hunk.content,
       });
       continue;
@@ -386,7 +393,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
     if (hunk.kind === "delete") {
       if (!source.file.exists) throw new Error(`Cannot delete missing file '${hunk.path}'.`);
       if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
-      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(root, source.absolute, hunk.path) });
+      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(cwd, source.absolute, hunk.path) });
       source.file.exists = false;
       source.file.content = undefined;
       continue;
@@ -395,7 +402,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
     if (!source.file.exists) throw new Error(`Cannot update missing file '${hunk.path}'.`);
     if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot update non-file '${hunk.path}'.`);
     const original = await getVirtualContent(source.absolute, source.file);
-    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, root) : undefined;
+    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, cwd) : undefined;
     if (moveTo === source.absolute) throw new Error(`Cannot move '${hunk.path}' onto itself.`);
 
     let destination: { absolute: string; file: VirtualFile } | undefined;
@@ -411,9 +418,9 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "update",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         moveTo: moveTo!,
-        moveDisplayPath: displayPath(root, moveTo!, hunk.moveTo!),
+        moveDisplayPath: displayPath(cwd, moveTo!, hunk.moveTo!),
         chunkGroups: [[...hunk.chunks]],
         content,
       });
@@ -434,7 +441,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "update",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         chunkGroups: [[...hunk.chunks]],
         content,
       });
@@ -445,19 +452,16 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
   return operations;
 }
 
-function resolvePatchPath(rawPath: string, root: string): string {
-  const absolute = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  if (!isWithin(root, absolute) || absolute === root) {
-    throw new Error(`Patch path must stay inside the current working directory: ${rawPath}`);
-  }
-  return absolute;
+function resolvePatchPath(rawPath: string, cwd: string): string {
+  return isAbsolute(rawPath) ? resolve(rawPath) : resolve(cwd, rawPath);
 }
 
-async function safePath(rawPath: string, root: string, signal?: AbortSignal): Promise<SafePath> {
+async function safePath(rawPath: string, cwd: string, signal?: AbortSignal): Promise<SafePath> {
   throwIfAborted(signal);
-  const absolute = resolvePatchPath(rawPath, root);
+  const absolute = resolvePatchPath(rawPath, cwd);
 
   let current = absolute;
+  let target: Omit<SafePath, "absolute"> = { exists: false, isDirectory: false, isFile: false };
   while (true) {
     throwIfAborted(signal);
     try {
@@ -465,25 +469,18 @@ async function safePath(rawPath: string, root: string, signal?: AbortSignal): Pr
       if (stats.isSymbolicLink()) {
         throw new Error(`Symlink paths are not allowed in apply_patch: ${rawPath}`);
       }
-      const resolved = await realpath(current);
-      if (!isWithin(root, resolved)) {
-        throw new Error(`Patch path escapes the current working directory: ${rawPath}`);
-      }
       if (current !== absolute && !stats.isDirectory()) {
         throw new Error(`Parent path is not a directory: ${rawPath}`);
       }
-      return {
-        absolute,
-        exists: current === absolute,
-        isDirectory: current === absolute && stats.isDirectory(),
-        isFile: current === absolute && stats.isFile(),
-      };
+      if (current === absolute) {
+        target = { exists: true, isDirectory: stats.isDirectory(), isFile: stats.isFile() };
+      }
     } catch (error) {
       if (!isMissingPathError(error)) throw error;
-      const parent = dirname(current);
-      if (parent === current) throw new Error(`Cannot resolve patch path: ${rawPath}`);
-      current = parent;
     }
+    const parent = dirname(current);
+    if (parent === current) return { absolute, ...target };
+    current = parent;
   }
 }
 
@@ -528,7 +525,7 @@ async function openSecureParentDirectory(rootFd: number, root: string, absolute:
   const relativeParent = relative(root, parentPath);
   const components = relativeParent ? relativeParent.split(sep) : [];
   if (components.some((component) => !component || component === "." || component === "..")) {
-    throw new Error(`Patch path must stay inside the current working directory: ${absolute}`);
+    throw new Error(`Patch path cannot be traversed securely: ${absolute}`);
   }
 
   let current = rootFd;
@@ -727,11 +724,6 @@ function displayPath(root: string, absolute: string, fallback: string): string {
   return relativePath && !relativePath.startsWith("..") ? relativePath : fallback;
 }
 
-function isWithin(root: string, candidate: string): boolean {
-  const path = relative(root, candidate);
-  return path === "" || (!path.startsWith("..") && !isAbsolute(path));
-}
-
 function isMissingPathError(error: unknown): boolean {
   return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }

package/src/patch-preview.ts

@@ -5,6 +5,7 @@
 // (it never throws) to drive a live, write-style glimpse of the content plus a running
 // added/removed tally. It reuses Pi's shared `renderDiff` primitive for +/- coloring, so the
 // preview stays consistent with the built-in `edit` tool's diff preview.
+import { stripTerminalSequences } from "@earendil-works/pi-tui";
 import { keyHint, type Theme } from "@earendil-works/pi-coding-agent";
 
 const FILE_ADD = "*** Add File: ";
@@ -26,6 +27,11 @@ const MAX_PREVIEW_BYTES = 256 * 1024;
 const MAX_PREVIEW_FILES = 500;
 /** Cap a single rendered glimpse line so minified/generated content cannot flood the TUI. */
 const PREVIEW_LINE_CHARS = 200;
+const TERMINAL_CONTROL_CHARS = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F]/g;
+
+function sanitizeTerminalText(text: string): string {
+  return stripTerminalSequences(text).replace(TERMINAL_CONTROL_CHARS, "").replace(/\t/g, "   ");
+}
 
 export type PatchLineType = "add" | "del" | "ctx";
 
@@ -156,8 +162,10 @@ function fileMarkLabel(file: PatchPreviewFile, theme: Theme): string {
 }
 
 function filePathLabel(file: PatchPreviewFile, theme: Theme): string {
-  const path = theme.fg("accent", truncatePath(file.path));
-  return file.moveTo ? `${path} ${theme.fg("muted", "->")} ${theme.fg("accent", truncatePath(file.moveTo))}` : path;
+  const path = theme.fg("accent", truncatePath(sanitizeTerminalText(file.path)));
+  return file.moveTo
+    ? `${path} ${theme.fg("muted", "->")} ${theme.fg("accent", truncatePath(sanitizeTerminalText(file.moveTo)))}`
+    : path;
 }
 
 function formatFileRosterLine(file: PatchPreviewFile, theme: Theme): string {
@@ -177,7 +185,8 @@ function countLines(file: PatchPreviewFile, type: PatchLineType): number {
  */
 function renderGlimpseLine(line: PatchPreviewLine, theme: Theme): string {
   const sign = line.type === "add" ? "+" : line.type === "del" ? "-" : " ";
-  const body = line.text.length > PREVIEW_LINE_CHARS ? `${line.text.slice(0, PREVIEW_LINE_CHARS)}…` : line.text;
+  const text = sanitizeTerminalText(line.text);
+  const body = text.length > PREVIEW_LINE_CHARS ? `${text.slice(0, PREVIEW_LINE_CHARS)}…` : text;
   const styled = `${sign}${body}`;
   if (line.type === "add") return theme.fg("toolDiffAdded", styled);
   if (line.type === "del") return theme.fg("toolDiffRemoved", styled);
@@ -263,5 +272,5 @@ export function formatApplyPatchResultText(
     .map((part) => part.text ?? "")
     .join("\n")
     .trim();
-  return output ? theme.fg("error", output) : undefined;
+  return output ? theme.fg("error", sanitizeTerminalText(output)) : undefined;
 }