pi-codex-tools 0.2.2 → 0.2.4

package/CHANGELOG.md

@@ -6,6 +6,18 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.2.4] - 2026-09-11
+
+### Fixed
+
+- Supply owned apply_patch grammar metadata to pi-codex-compaction through Pi's public event bus.
+
+## [0.2.3] - 2026-08-11
+
+### Changed
+
+- Accept relative paths outside the current working directory and absolute paths, matching Pi's native `edit` and `write` tools while preserving no-follow filesystem operations.
+
 ## [0.2.2] - 2026-08-10
 
 ### Changed

package/README.md

@@ -6,7 +6,7 @@ Give grammar-capable OpenAI/Codex models the Codex `apply_patch` tool in Pi with
 
 - **Raw `apply_patch`** — sends Codex's Lark grammar as an OpenAI custom tool, so patches are not JSON-wrapped.
 - **Capability-based activation** — requires `openai-codex-responses` or `openai-responses` plus `model.compat.supportsOpenAIGrammarTools === true`; model names alone are never enough.
-- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, stay under Pi's current working directory, reject symlink escapes, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
+- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, accept relative or absolute paths like Pi's native file tools, reject symlink paths, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
 - **Model switching** — supported models replace Pi's `edit` and `write` tools with `apply_patch`; other active tools are preserved. Switching back restores only the file tools that were active before the switch.
 - **Sequential patch calls** — the extension marks patch execution sequential while leaving provider-side parallel tool calls enabled.
 - **Streaming progress** — while a patch is generated, the TUI shows a live, color-coded glimpse of the content being written (new-file content, or `+`/`-` lines for updates) plus a running `+added -removed` tally and a per-file roster for multi-file patches. It reuses Pi's shared diff rendering and mirrors the built-in `write`/`edit` previews; patch execution is unchanged.
@@ -40,6 +40,11 @@ These choices are based on the Codex tool specifications in `codex-rs/core/src/t
 
 ## Compatibility notes
 
+With an updated `pi-codex-compaction` installed, the package supplies its owned
+grammar metadata through Pi's public event bus. This keeps raw `apply_patch`
+calls and results intact in direct Codex compaction requests, including Astra.
+No private Pi registry is patched.
+
 `apply_patch` is line-oriented rather than byte-oriented:
 
 - `*** Add File` requires at least one `+` line and writes a trailing newline. A `+`-only hunk creates a one-newline file, not a zero-byte file.

package/SECURITY.md

@@ -19,7 +19,7 @@ Report privately through [GitHub Security Advisories](https://github.com/jvm/pi-
 
 Pi extensions execute with the same permissions as the local user running Pi. Review installed extensions and only install packages from sources you trust.
 
-`apply_patch` does not access the network or credential APIs. It can read credential-containing files when a patch targets them. It validates paths beneath the current working directory, rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot escape. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for `darwin-arm64` and `darwin-x64`, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those three POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
+`apply_patch` does not access the network or credential APIs. Like Pi's native `edit` and `write` tools, it accepts relative or absolute paths and can modify files outside the current working directory with the local user's permissions. It can read credential-containing files when a patch targets them. It rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a filesystem-root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot redirect a mutation. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for Apple silicon and Intel, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
 
 The package strips untrusted C0/C1 control bytes and terminal escape sequences from `apply_patch` preview text and paths before handing them to the TUI. The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
 

package/extensions/index.ts

@@ -44,7 +44,7 @@ export default function piCodexTools(pi: ExtensionAPI): void {
     promptGuidelines: [
       "Use apply_patch for file changes when it is available.",
       "Send the patch body directly; do not wrap it in JSON or add a shell heredoc.",
-      `Patch paths must stay inside the current working directory and patches are limited to ${MAX_PATCH_BYTES} bytes.`,
+      `Patch paths may be relative to the current working directory or absolute, and patches are limited to ${MAX_PATCH_BYTES} bytes.`,
     ],
     parameters: APPLY_PATCH_PARAMETERS,
     constrainedSampling: createOpenAILarkSampling(APPLY_PATCH_GRAMMAR),
@@ -90,6 +90,20 @@ export default function piCodexTools(pi: ExtensionAPI): void {
 
   let replacedToolsWasActive: Record<ReplacedTool, boolean> | undefined;
 
+  pi.events?.on("pi-codex-compaction:tools:v1", (value) => {
+    const data = value as {
+      model?: ExtensionContext["model"];
+      tools?: Array<{ name: string; parameters: unknown; constrainedSampling?: OpenAIGrammarSampling }>;
+    } | undefined;
+    if (!data || !supportsOpenAIGrammarTools(data.model) || !Array.isArray(data.tools)) return;
+    for (const tool of data.tools) {
+      // Do not attach our grammar to another extension's apply_patch override.
+      if (tool.name === APPLY_PATCH && tool.parameters === APPLY_PATCH_PARAMETERS) {
+        tool.constrainedSampling = createOpenAILarkSampling(APPLY_PATCH_GRAMMAR);
+      }
+    }
+  });
+
   function synchronizeTools(ctx: ExtensionContext): void {
     if (typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function") return;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-tools",
-  "version": "0.2.2",
+  "version": "0.2.4",
   "description": "Codex-compatible apply_patch tooling for Pi's grammar-capable OpenAI models.",
   "type": "module",
   "license": "Apache-2.0",
@@ -60,10 +60,10 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.84.1",
-    "@earendil-works/pi-coding-agent": "^0.84.1",
-    "@earendil-works/pi-tui": "^0.84.1",
-    "@types/node": "^26.1.2",
+    "@earendil-works/pi-ai": "^0.85.1",
+    "@earendil-works/pi-coding-agent": "^0.85.1",
+    "@earendil-works/pi-tui": "^0.85.1",
+    "@types/node": "^26.2.0",
     "prebuildify": "^6.0.1",
     "tsx": "^4.23.5",
     "typebox": "^1.3.10",

package/src/apply-patch.ts

@@ -298,17 +298,18 @@ type VirtualFile = Omit<SafePath, "absolute"> & { content?: string };
 export async function applyPatch(input: string, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
   requireSecureFilesystem();
   const hunks = parseApplyPatch(input);
-  const root = await realpath(resolve(options.cwd));
+  const cwd = await realpath(resolve(options.cwd));
+  const root = sep;
   const lockPaths = hunks.flatMap((hunk) => {
-    const paths = [resolvePatchPath(hunk.path, root)];
-    if (hunk.kind === "update" && hunk.moveTo) paths.push(resolvePatchPath(hunk.moveTo, root));
+    const paths = [resolvePatchPath(hunk.path, cwd)];
+    if (hunk.kind === "update" && hunk.moveTo) paths.push(resolvePatchPath(hunk.moveTo, cwd));
     return paths;
   });
 
   return withMutationLocks(lockPaths, async () => {
     const rootFd = await openSecureRoot(root, options.signal);
     try {
-      const operations = await planOperations(hunks, root, rootFd, options.signal);
+      const operations = await planOperations(hunks, cwd, root, rootFd, options.signal);
       throwIfAborted(options.signal);
       // ponytail: preflight catches parse/match errors before writes; cross-process failures can still leave a partial multi-file patch.
       for (const operation of operations) {
@@ -338,15 +339,21 @@ export async function applyPatch(input: string, options: ApplyPatchOptions): Pro
   });
 }
 
-async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: number, signal?: AbortSignal): Promise<PlannedOperation[]> {
+async function planOperations(
+  hunks: ApplyPatchHunk[],
+  cwd: string,
+  root: string,
+  rootFd: number,
+  signal?: AbortSignal,
+): Promise<PlannedOperation[]> {
   const operations: PlannedOperation[] = [];
   const virtualFiles = new Map<string, VirtualFile>();
 
   const getVirtualFile = async (rawPath: string): Promise<{ absolute: string; file: VirtualFile }> => {
-    const absolute = resolvePatchPath(rawPath, root);
+    const absolute = resolvePatchPath(rawPath, cwd);
     const existing = virtualFiles.get(absolute);
     if (existing) return { absolute, file: existing };
-    const safe = await safePath(rawPath, root, signal);
+    const safe = await safePath(rawPath, cwd, signal);
     const file: VirtualFile = {
       exists: safe.exists,
       isDirectory: safe.isDirectory,
@@ -377,7 +384,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "add",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         content: hunk.content,
       });
       continue;
@@ -386,7 +393,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
     if (hunk.kind === "delete") {
       if (!source.file.exists) throw new Error(`Cannot delete missing file '${hunk.path}'.`);
       if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
-      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(root, source.absolute, hunk.path) });
+      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(cwd, source.absolute, hunk.path) });
       source.file.exists = false;
       source.file.content = undefined;
       continue;
@@ -395,7 +402,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
     if (!source.file.exists) throw new Error(`Cannot update missing file '${hunk.path}'.`);
     if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot update non-file '${hunk.path}'.`);
     const original = await getVirtualContent(source.absolute, source.file);
-    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, root) : undefined;
+    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, cwd) : undefined;
     if (moveTo === source.absolute) throw new Error(`Cannot move '${hunk.path}' onto itself.`);
 
     let destination: { absolute: string; file: VirtualFile } | undefined;
@@ -411,9 +418,9 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "update",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         moveTo: moveTo!,
-        moveDisplayPath: displayPath(root, moveTo!, hunk.moveTo!),
+        moveDisplayPath: displayPath(cwd, moveTo!, hunk.moveTo!),
         chunkGroups: [[...hunk.chunks]],
         content,
       });
@@ -434,7 +441,7 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
       operations.push({
         kind: "update",
         path: source.absolute,
-        displayPath: displayPath(root, source.absolute, hunk.path),
+        displayPath: displayPath(cwd, source.absolute, hunk.path),
         chunkGroups: [[...hunk.chunks]],
         content,
       });
@@ -445,19 +452,16 @@ async function planOperations(hunks: ApplyPatchHunk[], root: string, rootFd: num
   return operations;
 }
 
-function resolvePatchPath(rawPath: string, root: string): string {
-  const absolute = isAbsolute(rawPath) ? resolve(rawPath) : resolve(root, rawPath);
-  if (!isWithin(root, absolute) || absolute === root) {
-    throw new Error(`Patch path must stay inside the current working directory: ${rawPath}`);
-  }
-  return absolute;
+function resolvePatchPath(rawPath: string, cwd: string): string {
+  return isAbsolute(rawPath) ? resolve(rawPath) : resolve(cwd, rawPath);
 }
 
-async function safePath(rawPath: string, root: string, signal?: AbortSignal): Promise<SafePath> {
+async function safePath(rawPath: string, cwd: string, signal?: AbortSignal): Promise<SafePath> {
   throwIfAborted(signal);
-  const absolute = resolvePatchPath(rawPath, root);
+  const absolute = resolvePatchPath(rawPath, cwd);
 
   let current = absolute;
+  let target: Omit<SafePath, "absolute"> = { exists: false, isDirectory: false, isFile: false };
   while (true) {
     throwIfAborted(signal);
     try {
@@ -465,25 +469,18 @@ async function safePath(rawPath: string, root: string, signal?: AbortSignal): Pr
       if (stats.isSymbolicLink()) {
         throw new Error(`Symlink paths are not allowed in apply_patch: ${rawPath}`);
       }
-      const resolved = await realpath(current);
-      if (!isWithin(root, resolved)) {
-        throw new Error(`Patch path escapes the current working directory: ${rawPath}`);
-      }
       if (current !== absolute && !stats.isDirectory()) {
         throw new Error(`Parent path is not a directory: ${rawPath}`);
       }
-      return {
-        absolute,
-        exists: current === absolute,
-        isDirectory: current === absolute && stats.isDirectory(),
-        isFile: current === absolute && stats.isFile(),
-      };
+      if (current === absolute) {
+        target = { exists: true, isDirectory: stats.isDirectory(), isFile: stats.isFile() };
+      }
     } catch (error) {
       if (!isMissingPathError(error)) throw error;
-      const parent = dirname(current);
-      if (parent === current) throw new Error(`Cannot resolve patch path: ${rawPath}`);
-      current = parent;
     }
+    const parent = dirname(current);
+    if (parent === current) return { absolute, ...target };
+    current = parent;
   }
 }
 
@@ -528,7 +525,7 @@ async function openSecureParentDirectory(rootFd: number, root: string, absolute:
   const relativeParent = relative(root, parentPath);
   const components = relativeParent ? relativeParent.split(sep) : [];
   if (components.some((component) => !component || component === "." || component === "..")) {
-    throw new Error(`Patch path must stay inside the current working directory: ${absolute}`);
+    throw new Error(`Patch path cannot be traversed securely: ${absolute}`);
   }
 
   let current = rootFd;
@@ -727,11 +724,6 @@ function displayPath(root: string, absolute: string, fallback: string): string {
   return relativePath && !relativePath.startsWith("..") ? relativePath : fallback;
 }
 
-function isWithin(root: string, candidate: string): boolean {
-  const path = relative(root, candidate);
-  return path === "" || (!path.startsWith("..") && !isAbsolute(path));
-}
-
 function isMissingPathError(error: unknown): boolean {
   return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }