pi-codex-tools 0.2.4 → 0.4.0

package/CHANGELOG.md

@@ -6,6 +6,35 @@ This project follows the spirit of [Keep a Changelog](https://keepachangelog.com
 
 ## [Unreleased]
 
+## [0.4.0] - 2026-10-09
+
+### Fixed
+
+- Clear theme-colored patch preview caches on invalidation so existing calls repaint after theme changes without another execution.
+
+### Changed
+
+- Add `codex_files` namespace metadata and accurate mutation/destruction hints without changing grammar, activation, model-only exposure or native file tools.
+- Remove the obsolete direct-compaction grammar event-bus adapter. Public server-side compaction preserves the ordinary request's grammar declarations.
+- Update the shared Pi development and contract-test baseline to 1.1.0; require Node.js >=22.19.0 to match the host runtime. Pi remains a host-supplied peer dependency.
+- Register `apply_patch` with model-only exposure, excluding nested calls through codemode.
+- Hide selected native `edit` and `write` declarations through Pi's public loadout hook while keeping their implementations, activation, and exposure intact for nested calls.
+- Preserve tool selection across reloads and model switches, including explicit activation and deactivation. Excluded tools remain excluded; older Pi runtimes retain the legacy selection policy.
+- Preserve approval wrappers regardless of extension load order or registration time, and leave native file tools intact when another extension overrides `apply_patch`.
+- On legacy Pi runtimes, hide reactivated file tools again on each supported-model switch while retaining them for restoration on unsupported models.
+
+## [0.3.0] - 2026-09-18
+
+### Changed
+
+- Follow symlinked files and parents with Pi-style filesystem access. Delete removes a symlink itself; move preserves its source referent.
+- Replace the platform-gated no-follow implementation with Node filesystem APIs and remove the macOS native binding and its dependencies.
+- Share preflight content and deduplicate mutation locks across symlink aliases while retaining patch limits and sequential execution.
+
+### Added
+
+- GPT-6 Astra integration coverage for grammar serialization, streamed raw patch execution through symlinked paths, and custom-tool result replay on both Pi Responses transports.
+
 ## [0.2.4] - 2026-09-11
 
 ### Fixed

package/CONTRIBUTING.md

@@ -33,3 +33,9 @@ Before opening a pull request:
 ## Code of conduct
 
 This project follows the Contributor Covenant Code of Conduct.
+## Pi 1.1.0 terminal audit
+
+From the monorepo root, run `node --import tsx --test tests/tui-contracts.test.mjs`.
+The suite uses actual regular/fullscreen tool shells, theme invalidation, resize,
+Unicode and host-owned output padding. See `tests/TUI_AUDIT.md` for remaining
+physical-terminal and export acceptance checks.

package/README.md

@@ -5,9 +5,11 @@ Give grammar-capable OpenAI/Codex models the Codex `apply_patch` tool in Pi with
 ## What it adds
 
 - **Raw `apply_patch`** — sends Codex's Lark grammar as an OpenAI custom tool, so patches are not JSON-wrapped.
+- **Model-only exposure** — `apply_patch` is available directly to the model, never through codemode or other nested tool calls. Requires Pi 0.99.1 or newer.
 - **Capability-based activation** — requires `openai-codex-responses` or `openai-responses` plus `model.compat.supportsOpenAIGrammarTools === true`; model names alone are never enough.
-- **Safe local mutation** — patches are limited to 1 MiB, target files to 64 MiB, accept relative or absolute paths like Pi's native file tools, reject symlink paths, use descriptor-anchored no-follow operations on Linux and macOS, fail closed elsewhere, preflight all hunks, and serialize writes with Pi's mutation queue.
-- **Model switching** — supported models replace Pi's `edit` and `write` tools with `apply_patch`; other active tools are preserved. Switching back restores only the file tools that were active before the switch.
+- **Pi-style filesystem access** — accepts relative or absolute paths and follows symlinked files and directories, including macOS `/tmp`. Uses Node filesystem APIs without a native binding or platform gate.
+- **Validated patches** — limits patches to 1 MiB and target-file reads to 64 MiB, preflights all hunks, and serializes writes with Pi's mutation queue.
+- **Native editing through codemode** — supported models see `apply_patch` instead of native `edit` and `write` declarations. Selected native tools remain active and callable through codemode, without replacing their implementations. Model switches and reloads preserve tool selection and approval wrappers. Keep your usual `defaultTools` selection; no separate exposure extension is needed.
 - **Sequential patch calls** — the extension marks patch execution sequential while leaving provider-side parallel tool calls enabled.
 - **Streaming progress** — while a patch is generated, the TUI shows a live, color-coded glimpse of the content being written (new-file content, or `+`/`-` lines for updates) plus a running `+added -removed` tally and a per-file roster for multi-file patches. It reuses Pi's shared diff rendering and mirrors the built-in `write`/`edit` previews; patch execution is unchanged.
 
@@ -25,7 +27,7 @@ pi -e /path/to/pi-mono/packages/pi-codex-tools
 
 ## Scope decisions
 
-The current Codex source does not define separate `read_file` or `write_file` tools: file inspection is normally done through shell commands and file mutation through `apply_patch`. This package keeps Pi's bounded `read` and `bash` tools, and uses `apply_patch` in place of Pi's `edit` and `write` tools for supported models. Because Pi does not provide Codex's OS-level filesystem sandbox, `apply_patch` performs its own TOCTOU-safe, no-follow directory walk: on Linux it re-opens each component relative to a trusted fd via `/proc/self/fd`, and on macOS via a tiny bundled `openat`/`mkdirat`/`unlinkat` N-API binding (prebuilt for Apple silicon and Intel). It fails closed on platforms without that support, in which case the native `edit`/`write` tools stay active. `apply_patch` also requires a Pi model runtime that advertises `compat.supportsOpenAIGrammarTools`; older runtimes leave the tool inactive.
+The current Codex source does not define separate `read_file` or `write_file` tools: file inspection is normally done through shell commands and file mutation through `apply_patch`. This package keeps Pi's bounded `read` and `bash` tools, and presents `apply_patch` in place of native `edit` and `write` declarations for supported models. Filesystem access uses the local user's permissions, like native Pi tools; it is not a sandbox. `apply_patch` requires a Pi model runtime that advertises `compat.supportsOpenAIGrammarTools`; older runtimes leave the tool inactive.
 
 | Codex surface | Decision |
 | --- | --- |
@@ -40,11 +42,74 @@ These choices are based on the Codex tool specifications in `codex-rs/core/src/t
 
 ## Compatibility notes
 
-With an updated `pi-codex-compaction` installed, the package supplies its owned
-grammar metadata through Pi's public event bus. This keeps raw `apply_patch`
-calls and results intact in direct Codex compaction requests, including Astra.
+The Pi 1.1.0 metadata contract groups `apply_patch` under `codex_files`, without
+renaming it or changing exposure. Its advisory hints are mutating, destructive,
+non-idempotent, and local-only. There is no public output schema: it intentionally
+remains model-only, not discoverable/callable from scripts. Metadata does not
+replace approvals or change native file-tool implementations.
+
+While this package's `apply_patch` is active on Pi 0.99.1 or newer, its public
+`prepareLoadout` hook hides selected native `edit` and `write` declarations from
+model requests. The tools keep their original implementations and `direct`
+exposure, and remain in `pi.getActiveTools()`. Activate `codemode` to call them
+from scripts; `describeTool("edit")` and `describeTool("write")` provide their
+schemas. The `apply_patch` description points to these helpers when codemode is
+active, including in codemode's `on` mode where direct tools are not listed
+inline.
+
+Explicitly activating a native file tool makes it callable but does not reveal
+its declaration while `apply_patch` is active. Deactivating it removes nested
+access too. Switching to an unsupported model stops hiding native declarations;
+other loadout hooks, such as codemode's `only` mode, still apply. Reloads preserve
+the active selection without a package-owned snapshot.
+
+Tools omitted from `defaultTools` or an explicit `--tools` selection are not
+introduced into codemode. Other extensions' file-tool implementations, including
+approval wrappers registered during or after `session_start`, are not replaced
+or hidden by this package. If another extension replaces `apply_patch`, this
+package's loadout hook does not apply to that replacement.
+
+Older Pi runtimes without exposure metadata retain the legacy behavior:
+supported models replace active file tools with `apply_patch`, without
+registering codemode overrides. They do not offer this package's nested native
+editing route; upgrade Pi for that capability. The fallback restores its saved
+file-tool selection when leaving supported models. Older Pi cannot distinguish
+an explicit deactivation of an already-hidden tool from leaving it unchanged.
+To disable such a tool, switch to an unsupported model before changing the
+selection, or upgrade Pi to preserve explicit deactivation while `apply_patch`
+is active.
+
+### GPT-6 Astra
+
+A Pi 1.1.0 virtual-model selection does not advertise the physical request's
+grammar capability to this extension. `apply_patch` stays unavailable even when
+the router chooses Astra; selected native `edit` and `write` declarations remain
+available, subject to other loadout hooks. The extension does not infer support
+from a virtual model name or reactivate excluded tools.
+
+Pi 0.85.1's model catalog advertises grammar-tool support for `gpt-6-astra` on both `openai-responses` and `openai-codex-responses`. The extension uses that capability directly, with no model-name allowlist or JSON wrapper. Tests cover the pinned Pi transports, streamed raw calls, execution, and result replay using mocked HTTP responses; they do not certify live account access.
+
+The [GPT-6 guide](https://developers.openai.com/api/docs/guides/latest-model?model=gpt-6-astra) also describes async tool calls, mid-turn steering, and reasoning updates. Those belong to the provider/session runtime and are not enabled by this extension. Patch execution remains sequential; provider-side parallel tool calling remains enabled.
+
+With `pi-codex-compaction` installed, public server-side compaction uses Pi's
+ordinary effective request, including this tool's grammar, calls and results.
+The former direct-compaction grammar event-bus adapter has been removed.
 No private Pi registry is patched.
 
+### Filesystem behavior
+
+- Add and update follow file symlinks and preserve the links. Add can create the target of a dangling symlink.
+- Symlinked parents work for add, update, delete, and move, including paths outside the current directory.
+- Delete removes the named entry. Deleting a symlink leaves its target unchanged.
+- Move writes the updated content to the destination, then removes the source entry. A symlink destination is followed; a symlink source is removed without deleting its target.
+- Preflight shares virtual content across symlink aliases and rejects moves onto the same resolved target.
+- Symlink loops are rejected.
+- Patches operate on regular text files, not directories, devices, sockets, or pipes.
+
+Like native Pi tools, normal path-based I/O does not protect against another process replacing a path during execution. Preflight is not a transaction; an I/O failure can leave earlier files changed. See [SECURITY.md](./SECURITY.md).
+
+### Text format
+
 `apply_patch` is line-oriented rather than byte-oriented:
 
 - `*** Add File` requires at least one `+` line and writes a trailing newline. A `+`-only hunk creates a one-newline file, not a zero-byte file.
@@ -54,7 +119,17 @@ No private Pi registry is patched.
 
 These behaviors intentionally match Codex `apply_patch`.
 
-The provider contract is runtime-specific: use Pi 0.83.0 or newer for OpenAI grammar-tool support. For a manual smoke test, start Pi with this extension and a model that advertises `supportsOpenAIGrammarTools`, then verify that a file change appears as an `apply_patch` call and not as `edit`, `write`, or `bash`.
+The provider contract is runtime-specific: use Pi 0.99.1 or newer for model-only tool exposure and the loadout hook; the metadata contract and development/integration tests use Pi 1.1.0.
+
+For a manual smoke test:
+
+1. Start Pi with this extension, the normal file tools, `codemode`, and a model that advertises `supportsOpenAIGrammarTools`.
+2. Ask it to create and update a disposable file through a symlinked directory (on macOS, `/tmp` is suitable). Verify raw `apply_patch` calls, changed referent content, and an intact symlink.
+3. Verify that `describeTool("edit")` and `describeTool("write")` work inside codemode and that scripts can edit a disposable file. `apply_patch` must not be callable inside codemode.
+4. Run `/reload` and repeat the nested-editing check.
+5. Switch to an unsupported model and verify that the selected native file tools remain usable. With codemode in `on` mode, their direct declarations return.
+
+Automated contract tests cover provider declarations, codemode's `on` and `only` modes, reloads, exclusions, and approval wrappers registered in either extension load order.
 
 ## Development
 

package/SECURITY.md

@@ -19,7 +19,24 @@ Report privately through [GitHub Security Advisories](https://github.com/jvm/pi-
 
 Pi extensions execute with the same permissions as the local user running Pi. Review installed extensions and only install packages from sources you trust.
 
-`apply_patch` does not access the network or credential APIs. Like Pi's native `edit` and `write` tools, it accepts relative or absolute paths and can modify files outside the current working directory with the local user's permissions. It can read credential-containing files when a patch targets them. It rejects symlink paths and symlinked parents, limits patch input to 1 MiB and target-file reads to 64 MiB, preflights file changes before writing, and performs a filesystem-root-anchored descriptor-based no-follow directory walk so a path component swapped to a symlink between check and use cannot redirect a mutation. On Linux the walk re-opens each component via `/proc/self/fd`; on macOS it uses a bundled `openat`/`mkdirat`/`unlinkat` N-API binding (committed prebuilds for Apple silicon and Intel, loaded via `node-gyp-build`) because Node does not expose `openat` and macOS lacks procfs. The binding is darwin-only, exposes only those POSIX calls, and is loaded best-effort: on platforms without it `apply_patch` fails closed and Pi keeps its native `edit`/`write` tools. A failure during a multi-file write can still leave earlier files changed; callers should use version control and review the resulting diff.
+On modern Pi, this package hides selected native `edit` and `write` declarations
+with the public loadout hook. It does not replace their implementations or alter
+their activation or exposure. Approval wrappers remain effective even when
+registered by a later-loaded extension during or after session startup. Nested
+calls use Pi's normal tool validation and `tool_call`/`tool_result` hooks.
+
+Hiding a declaration is presentation, not an execution or permission boundary:
+active tools remain executable. Tools excluded from the active selection are
+not introduced into codemode by this package. Older Pi runtimes without exposure
+metadata retain the legacy tool-selection policy without nested-editing
+overrides. Tool selections are not an OS-level sandbox; `apply_patch` itself can
+modify files when enabled.
+
+`apply_patch` does not access the network or credential APIs. Like Pi's native `edit` and `write` tools, it accepts relative or absolute paths, follows symlinks for reads/writes, and can modify files outside the current working directory with the local user's permissions. It can read credential-containing files when a patch targets them. Deleting a symlink removes the link, not its referent; moving a symlink source copies its referent's updated content and removes the source link.
+
+The tool uses Node filesystem APIs without a platform-specific native binding. This deliberately replaces the previous no-follow policy with Pi-style filesystem access. Path canonicalization is used for preflight identity and queue keys, not as a security boundary. There is no workspace confinement or protection against another process swapping path components between resolution and I/O. Use an OS-level sandbox or restricted user account when filesystem isolation is required.
+
+Patch input is limited to 1 MiB, hunk count to 1,000, and target-file reads to 64 MiB. Preflight rejects non-file write targets and checks all hunk matches before mutation. Symlink aliases share virtual file state and deduplicated mutation queues. Queues serialize cooperating Pi mutations and remain held until pending I/O settles; they do not lock out other processes. A failure or cancellation during a multi-file write can still leave earlier files changed. Use version control and review the resulting diff.
 
 The package strips untrusted C0/C1 control bytes and terminal escape sequences from `apply_patch` preview text and paths before handing them to the TUI. The package reads the current provider/model capability flags only to select tools. It does not log prompts, patches, file contents, credentials, auth headers, or provider responses.
 

package/extensions/index.ts

@@ -2,7 +2,7 @@ import { Container, Text } from "@earendil-works/pi-tui";
 import type { Component } from "@earendil-works/pi-tui";
 import type { ExtensionAPI, ExtensionContext } from "@earendil-works/pi-coding-agent";
 import { reportInstallTelemetry } from "../src/install-telemetry.js";
-import { applyPatch, APPLY_PATCH_GRAMMAR, MAX_PATCH_BYTES, secureFilesystemSupported } from "../src/apply-patch.js";
+import { applyPatch, APPLY_PATCH_GRAMMAR, MAX_PATCH_BYTES } from "../src/apply-patch.js";
 import { createFreeformInputSchema, createOpenAILarkSampling, type OpenAIGrammarSampling } from "../src/grammar.js";
 import { supportsOpenAIGrammarTools } from "../src/model-support.js";
 import { formatApplyPatchCallText, formatApplyPatchResultText } from "../src/patch-preview.js";
@@ -12,6 +12,11 @@ class ApplyPatchCallComponent extends Text {
   constructor() {
     super("", 0, 0);
   }
+
+  override invalidate(): void {
+    this.cache = undefined;
+    super.invalidate();
+  }
 }
 
 function readPatchArg(args: unknown): string {
@@ -19,10 +24,9 @@ function readPatchArg(args: unknown): string {
 }
 
 const APPLY_PATCH = "apply_patch";
-const EDIT = "edit";
-const WRITE = "write";
-const REPLACED_TOOLS = [EDIT, WRITE] as const;
-type ReplacedTool = (typeof REPLACED_TOOLS)[number];
+const FILE_TOOLS = ["edit", "write"] as const;
+type FileTool = (typeof FILE_TOOLS)[number];
+const APPLY_PATCH_DESCRIPTION = "Apply a Codex patch to files. This is a FREEFORM tool: send the patch text directly, never as JSON.";
 
 const APPLY_PATCH_PARAMETERS = createFreeformInputSchema(
   "patch",
@@ -38,17 +42,45 @@ export default function piCodexTools(pi: ExtensionAPI): void {
 
   registerGrammarTool({
     name: APPLY_PATCH,
+    namespace: {
+      name: "codex_files",
+      description: "Direct model-only grammar-based file patches.",
+      instructions: "apply_patch stays model-only and requires a grammar-capable OpenAI model. Send raw patch text directly; never call it from codemode or replace native file tools to alter visibility. File changes may overwrite or delete local data and remain subject to approval hooks.",
+    },
+    annotations: { readOnlyHint: false, destructiveHint: true, idempotentHint: false, openWorldHint: false },
+    exposure: "model-only",
     label: APPLY_PATCH,
-    description: "Apply a Codex patch to files. This is a FREEFORM tool: send the patch text directly, never as JSON.",
+    description: APPLY_PATCH_DESCRIPTION,
     promptSnippet: "Apply Codex-format file patches without JSON wrapping",
     promptGuidelines: [
       "Use apply_patch for file changes when it is available.",
       "Send the patch body directly; do not wrap it in JSON or add a shell heredoc.",
       `Patch paths may be relative to the current working directory or absolute, and patches are limited to ${MAX_PATCH_BYTES} bytes.`,
+      "apply_patch follows symlinks for file writes; deleting a symlink removes the link, not its target.",
     ],
     parameters: APPLY_PATCH_PARAMETERS,
     constrainedSampling: createOpenAILarkSampling(APPLY_PATCH_GRAMMAR),
     executionMode: "sequential",
+    prepareLoadout(loadout) {
+      const tools = pi.getAllTools();
+      // Hide declarations, not implementations or activation. Registering native
+      // replacements would outrank approval tools registered by later extensions.
+      const hiddenDeclarations = FILE_TOOLS.filter((name) =>
+        loadout.declared.some((tool) => tool.name === name)
+        && tools.some((tool) => tool.name === name && tool.sourceInfo?.path === `builtin:${name}`),
+      );
+      if (hiddenDeclarations.length === 0) return;
+      return {
+        hiddenDeclarations,
+        // Codemode's "on" mode does not list direct tools in its own description.
+        // Keep the hidden tools discoverable without overriding codemode's hook.
+        descriptions: loadout.declared.some((tool) => tool.name === "codemode") ? {
+          [APPLY_PATCH]: `${APPLY_PATCH_DESCRIPTION}\n\nNative ${hiddenDeclarations.join(" and ")} remain callable through codemode. Use ${
+            hiddenDeclarations.map((name) => `describeTool("${name}")`).join(" and ")
+          } for their schemas and usage guidance.`,
+        } : undefined,
+      };
+    },
     renderCall(args, theme, context) {
       const component =
         context.lastComponent instanceof ApplyPatchCallComponent ? context.lastComponent : new ApplyPatchCallComponent();
@@ -88,43 +120,31 @@ export default function piCodexTools(pi: ExtensionAPI): void {
     },
   });
 
-  let replacedToolsWasActive: Record<ReplacedTool, boolean> | undefined;
-
-  pi.events?.on("pi-codex-compaction:tools:v1", (value) => {
-    const data = value as {
-      model?: ExtensionContext["model"];
-      tools?: Array<{ name: string; parameters: unknown; constrainedSampling?: OpenAIGrammarSampling }>;
-    } | undefined;
-    if (!data || !supportsOpenAIGrammarTools(data.model) || !Array.isArray(data.tools)) return;
-    for (const tool of data.tools) {
-      // Do not attach our grammar to another extension's apply_patch override.
-      if (tool.name === APPLY_PATCH && tool.parameters === APPLY_PATCH_PARAMETERS) {
-        tool.constrainedSampling = createOpenAILarkSampling(APPLY_PATCH_GRAMMAR);
-      }
-    }
-  });
+  let legacyReplacedTools: Set<FileTool> | undefined;
 
   function synchronizeTools(ctx: ExtensionContext): void {
     if (typeof pi.getActiveTools !== "function" || typeof pi.setActiveTools !== "function") return;
 
     const active = new Set(pi.getActiveTools());
-    if (supportsOpenAIGrammarTools(ctx.model) && secureFilesystemSupported()) {
-      if (replacedToolsWasActive === undefined) {
-        replacedToolsWasActive = {
-          edit: active.has(EDIT),
-          write: active.has(WRITE),
-        };
+    const tools = typeof pi.getAllTools === "function" ? pi.getAllTools() : [];
+    // Exposure metadata and prepareLoadout arrived together. Do not infer runtime
+    // support or this extension's ownership from an overridable apply_patch tool.
+    const supportsLoadout = tools.some((tool) => tool.exposure !== undefined);
+    if (supportsOpenAIGrammarTools(ctx.model)) {
+      if (!supportsLoadout) {
+        // Older runtimes cannot hide declarations independently of activation.
+        // Re-hide later activations on every supported-model switch, retaining
+        // them for restoration when leaving the supported models.
+        legacyReplacedTools ??= new Set();
+        for (const name of FILE_TOOLS) {
+          if (active.delete(name)) legacyReplacedTools.add(name);
+        }
       }
-      for (const tool of REPLACED_TOOLS) active.delete(tool);
       active.add(APPLY_PATCH);
     } else {
       active.delete(APPLY_PATCH);
-      if (replacedToolsWasActive) {
-        for (const tool of REPLACED_TOOLS) {
-          if (replacedToolsWasActive[tool]) active.add(tool);
-        }
-      }
-      replacedToolsWasActive = undefined;
+      for (const name of legacyReplacedTools ?? []) active.add(name);
+      legacyReplacedTools = undefined;
     }
     pi.setActiveTools([...active]);
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-codex-tools",
-  "version": "0.2.4",
+  "version": "0.4.0",
   "description": "Codex-compatible apply_patch tooling for Pi's grammar-capable OpenAI models.",
   "type": "module",
   "license": "Apache-2.0",
@@ -35,8 +35,6 @@
     "index.ts",
     "extensions",
     "src",
-    "native",
-    "prebuilds",
     "README.md",
     "NOTICE",
     "LICENSE",
@@ -49,8 +47,6 @@
     "check": "tsc --noEmit",
     "typecheck": "tsc --noEmit",
     "test": "node --import tsx --test tests/*.test.mjs",
-    "build:native": "node-gyp configure build",
-    "prebuild:native": "prebuildify --napi --arch arm64 && prebuildify --napi --arch x64",
     "pack:dry-run": "npm pack --dry-run"
   },
   "peerDependencies": {
@@ -60,24 +56,21 @@
     "typebox": "*"
   },
   "devDependencies": {
-    "@earendil-works/pi-ai": "^0.85.1",
-    "@earendil-works/pi-coding-agent": "^0.85.1",
-    "@earendil-works/pi-tui": "^0.85.1",
-    "@types/node": "^26.2.0",
-    "prebuildify": "^6.0.1",
-    "tsx": "^4.23.5",
-    "typebox": "^1.3.10",
+    "@earendil-works/pi-ai": "1.1.0",
+    "@earendil-works/pi-coding-agent": "1.1.0",
+    "@earendil-works/pi-tui": "1.1.0",
+    "@types/node": "^26.6.3",
+    "tsx": "^4.23.15",
+    "typebox": "^1.3.34",
     "typescript": "^7.0.2"
   },
   "publishConfig": {
     "access": "public"
   },
   "engines": {
-    "node": ">=20.6.0"
+    "node": ">=22.19.0"
   },
   "dependencies": {
-    "@mocito/install-telemetry": "0.1.1",
-    "node-gyp-build": "^4.8.4"
-  },
-  "gypfile": false
+    "@mocito/install-telemetry": "0.1.1"
+  }
 }

package/src/apply-patch.ts

@@ -1,89 +1,13 @@
 // Adapted from OpenAI Codex apply-patch grammar/parser behavior; see NOTICE.
-import { constants, open as openCb, fstat as fstatCb, read as readCb, write as writeCb, close as closeCb, mkdir as mkdirCb, unlink as unlinkCb } from "node:fs";
-import type { Stats } from "node:fs";
-import { lstat, realpath } from "node:fs/promises";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+import { constants } from "node:fs";
+import { lstat, readlink, realpath, open, mkdir, unlink, writeFile } from "node:fs/promises";
+import { dirname, isAbsolute, relative, resolve, parse, join, sep } from "node:path";
 import { withFileMutationQueue } from "@earendil-works/pi-coding-agent";
-import { getOpenAtBindings } from "./native.js";
 
 export const MAX_PATCH_BYTES = 1_048_576;
 export const MAX_PATCH_HUNKS = 1_000;
 export const MAX_TARGET_FILE_BYTES = 64 * 1024 * 1024;
 
-const O_NOFOLLOW = constants.O_NOFOLLOW ?? 0;
-const SECURE_FD_DIRECTORY = process.platform === "linux" ? "/proc/self/fd" : undefined;
-const OPENAT_BINDINGS = getOpenAtBindings();
-const BASE_SECURE_FILESYSTEM_SUPPORTED =
-  (process.platform === "linux" && SECURE_FD_DIRECTORY !== undefined && O_NOFOLLOW !== 0) ||
-  (process.platform === "darwin" && OPENAT_BINDINGS !== null && O_NOFOLLOW !== 0);
-let secureFilesystemSupportedOverride: boolean | undefined;
-
-/** Whether apply_patch can safely execute against this platform's filesystem. */
-export function secureFilesystemSupported(): boolean {
-  return secureFilesystemSupportedOverride ?? BASE_SECURE_FILESYSTEM_SUPPORTED;
-}
-
-/** @internal Force the support flag so the activation path can be tested on any host platform. */
-export function setSecureFilesystemSupportedForTest(value: boolean | undefined): void {
-  secureFilesystemSupportedOverride = value;
-}
-
-const openFd = (path: string, flags: number, mode: number): Promise<number> =>
-  new Promise((resolveP, rejectP) => openCb(path, flags, mode, (error, fd) => (error ? rejectP(error) : resolveP(fd))));
-const fstatFd = (fd: number): Promise<Stats> =>
-  new Promise((resolveP, rejectP) => fstatCb(fd, (error, stats) => (error ? rejectP(error) : resolveP(stats))));
-const readFd = (fd: number, buffer: Buffer, offset: number, length: number, position: number | null): Promise<number> =>
-  new Promise((resolveP, rejectP) => readCb(fd, buffer, offset, length, position, (error, bytesRead) => (error ? rejectP(error) : resolveP(bytesRead))));
-const writeFd = (fd: number, buffer: Buffer, offset: number, length: number, position: number | null): Promise<number> =>
-  new Promise((resolveP, rejectP) => writeCb(fd, buffer, offset, length, position, (error, written) => (error ? rejectP(error) : resolveP(written))));
-const closeFd = (fd: number): Promise<void> =>
-  new Promise((resolveP, rejectP) => closeCb(fd, (error) => (error ? rejectP(error) : resolveP())));
-const mkdirPath = (path: string, mode: number): Promise<void> =>
-  new Promise((resolveP, rejectP) => mkdirCb(path, mode, (error) => (error ? rejectP(error) : resolveP())));
-const unlinkPath = (path: string): Promise<void> =>
-  new Promise((resolveP, rejectP) => unlinkCb(path, (error) => (error ? rejectP(error) : resolveP())));
-
-// Open `child` relative to a trusted open directory descriptor, never following the final component.
-async function openChildRelative(parentFd: number, child: string, flags: number, mode: number): Promise<number> {
-  if (OPENAT_BINDINGS) return OPENAT_BINDINGS.openat(parentFd, child, flags, mode);
-  return openFd(join(SECURE_FD_DIRECTORY as string, String(parentFd), child), flags, mode);
-}
-
-async function mkdirChildRelative(parentFd: number, child: string, mode: number): Promise<void> {
-  if (OPENAT_BINDINGS) {
-    OPENAT_BINDINGS.mkdirat(parentFd, child, mode);
-    return;
-  }
-  await mkdirPath(join(SECURE_FD_DIRECTORY as string, String(parentFd), child), mode);
-}
-
-async function unlinkChildRelative(parentFd: number, child: string): Promise<void> {
-  if (OPENAT_BINDINGS) {
-    OPENAT_BINDINGS.unlinkat(parentFd, child);
-    return;
-  }
-  await unlinkPath(join(SECURE_FD_DIRECTORY as string, String(parentFd), child));
-}
-
-// No-follow stat of `child` relative to a trusted descriptor, without opening it
-// (so unreadable files can still be inspected for symlink/directory rejection).
-async function lstatChildRelative(parentFd: number, child: string): Promise<{ isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean }> {
-  if (OPENAT_BINDINGS) return OPENAT_BINDINGS.lstatAt(parentFd, child);
-  const stats = await lstat(join(SECURE_FD_DIRECTORY as string, String(parentFd), child));
-  return { isFile: stats.isFile(), isDirectory: stats.isDirectory(), isSymbolicLink: stats.isSymbolicLink() };
-}
-
-async function writeAllFd(fd: number, data: string): Promise<void> {
-  const buffer = Buffer.from(data, "utf8");
-  let written = 0;
-  while (written < buffer.length) {
-    written += await writeFd(fd, buffer, written, buffer.length - written, written);
-  }
-}
-const SECURE_DIRECTORY_FLAGS = constants.O_RDONLY | O_NOFOLLOW | (constants.O_DIRECTORY ?? 0) | (constants.O_NONBLOCK ?? 0);
-const SECURE_READ_FLAGS = constants.O_RDONLY | O_NOFOLLOW | (constants.O_NONBLOCK ?? 0);
-const SECURE_UPDATE_FLAGS = constants.O_WRONLY | O_NOFOLLOW | constants.O_TRUNC | (constants.O_NONBLOCK ?? 0);
-const SECURE_CREATE_FLAGS = SECURE_UPDATE_FLAGS | constants.O_CREAT;
 const FILE_READ_CHUNK_BYTES = 64 * 1024;
 
 export const APPLY_PATCH_GRAMMAR = `start: begin_patch hunk+ end_patch
@@ -292,14 +216,12 @@ type PlannedOperation =
   | { kind: "delete"; path: string; displayPath: string }
   | { kind: "update"; path: string; displayPath: string; moveTo?: string; moveDisplayPath?: string; chunkGroups: UpdateChunk[][]; content: string };
 
-type SafePath = { absolute: string; exists: boolean; isDirectory: boolean; isFile: boolean };
-type VirtualFile = Omit<SafePath, "absolute"> & { content?: string };
+type VirtualFile = { exists: boolean; isDirectory: boolean; isFile: boolean; isSymbolicLink?: boolean; content?: string };
 
 export async function applyPatch(input: string, options: ApplyPatchOptions): Promise<ApplyPatchResult> {
-  requireSecureFilesystem();
   const hunks = parseApplyPatch(input);
+  throwIfAborted(options.signal);
   const cwd = await realpath(resolve(options.cwd));
-  const root = sep;
   const lockPaths = hunks.flatMap((hunk) => {
     const paths = [resolvePatchPath(hunk.path, cwd)];
     if (hunk.kind === "update" && hunk.moveTo) paths.push(resolvePatchPath(hunk.moveTo, cwd));
@@ -307,71 +229,61 @@ export async function applyPatch(input: string, options: ApplyPatchOptions): Pro
   });
 
   return withMutationLocks(lockPaths, async () => {
-    const rootFd = await openSecureRoot(root, options.signal);
-    try {
-      const operations = await planOperations(hunks, cwd, root, rootFd, options.signal);
+    const operations = await planOperations(hunks, cwd, options.signal);
+    throwIfAborted(options.signal);
+    // Preflight catches parse/match errors before writes; I/O failures can still leave a partial patch.
+    for (const operation of operations) {
       throwIfAborted(options.signal);
-      // ponytail: preflight catches parse/match errors before writes; cross-process failures can still leave a partial multi-file patch.
-      for (const operation of operations) {
+      if (operation.kind === "add") {
+        await writeTargetFile(operation.path, operation.content, options.signal);
+      } else if (operation.kind === "delete") {
+        await unlink(operation.path);
+      } else if (operation.moveTo) {
+        await writeTargetFile(operation.moveTo, operation.content, options.signal);
         throwIfAborted(options.signal);
-        if (operation.kind === "add") {
-          await writeSecureFile(rootFd, root, operation.path, operation.content, true, options.signal);
-        } else if (operation.kind === "delete") {
-          await removeSecureFile(rootFd, root, operation.path, options.signal);
-        } else if (operation.moveTo) {
-          await writeSecureFile(rootFd, root, operation.moveTo, operation.content, true, options.signal);
-          await removeSecureFile(rootFd, root, operation.path, options.signal);
-        } else {
-          await writeSecureFile(rootFd, root, operation.path, operation.content, false, options.signal);
-        }
+        await unlink(operation.path);
+      } else {
+        await writeTargetFile(operation.path, operation.content, options.signal);
       }
-
-      return {
-        changes: operations.map((operation) => ({
-          kind: operation.kind === "add" ? "added" : operation.kind === "delete" ? "deleted" : "updated",
-          path: operation.displayPath,
-          ...(operation.kind === "update" && operation.moveDisplayPath ? { moveTo: operation.moveDisplayPath } : {}),
-        })),
-      };
-    } finally {
-      await closeFd(rootFd);
     }
+
+    return {
+      changes: operations.map((operation) => ({
+        kind: operation.kind === "add" ? "added" : operation.kind === "delete" ? "deleted" : "updated",
+        path: operation.displayPath,
+        ...(operation.kind === "update" && operation.moveDisplayPath ? { moveTo: operation.moveDisplayPath } : {}),
+      })),
+    };
   });
 }
 
 async function planOperations(
   hunks: ApplyPatchHunk[],
   cwd: string,
-  root: string,
-  rootFd: number,
   signal?: AbortSignal,
 ): Promise<PlannedOperation[]> {
   const operations: PlannedOperation[] = [];
   const virtualFiles = new Map<string, VirtualFile>();
 
-  const getVirtualFile = async (rawPath: string): Promise<{ absolute: string; file: VirtualFile }> => {
-    const absolute = resolvePatchPath(rawPath, cwd);
+  const getVirtualFile = async (rawPath: string, followFinal = true): Promise<{ absolute: string; file: VirtualFile }> => {
+    const absolute = await canonicalPath(resolvePatchPath(rawPath, cwd), followFinal, virtualFiles, signal);
     const existing = virtualFiles.get(absolute);
-    if (existing) return { absolute, file: existing };
-    const safe = await safePath(rawPath, cwd, signal);
-    const file: VirtualFile = {
-      exists: safe.exists,
-      isDirectory: safe.isDirectory,
-      isFile: safe.isFile,
-    };
+    if (existing && !existing.isSymbolicLink) return { absolute, file: existing };
+    const file = await inspectPath(absolute);
     virtualFiles.set(absolute, file);
     return { absolute, file };
   };
 
   const getVirtualContent = async (absolute: string, file: VirtualFile): Promise<string> => {
     if (!file.exists || !file.isFile) throw new Error(`Cannot read non-file '${absolute}'.`);
-    if (file.content === undefined) file.content = await readSecureFile(rootFd, root, absolute, signal);
+    if (file.content === undefined) file.content = await readTargetFile(absolute, signal);
     return file.content;
   };
 
   for (const hunk of hunks) {
     throwIfAborted(signal);
-    const source = await getVirtualFile(hunk.path);
+    const source = await getVirtualFile(hunk.path, hunk.kind !== "delete");
+    const sourceDisplay = displayPath(cwd, resolvePatchPath(hunk.path, cwd), hunk.path);
 
     if (hunk.kind === "add") {
       if (source.file.isDirectory || (source.file.exists && !source.file.isFile)) {
@@ -384,7 +296,7 @@ async function planOperations(
       operations.push({
         kind: "add",
         path: source.absolute,
-        displayPath: displayPath(cwd, source.absolute, hunk.path),
+        displayPath: sourceDisplay,
         content: hunk.content,
       });
       continue;
@@ -392,9 +304,10 @@ async function planOperations(
 
     if (hunk.kind === "delete") {
       if (!source.file.exists) throw new Error(`Cannot delete missing file '${hunk.path}'.`);
-      if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
-      operations.push({ kind: "delete", path: source.absolute, displayPath: displayPath(cwd, source.absolute, hunk.path) });
+      if (!source.file.isSymbolicLink && (source.file.isDirectory || !source.file.isFile)) throw new Error(`Cannot delete non-file '${hunk.path}'.`);
+      operations.push({ kind: "delete", path: source.absolute, displayPath: sourceDisplay });
       source.file.exists = false;
+      source.file.isSymbolicLink = false;
       source.file.content = undefined;
       continue;
     }
@@ -402,12 +315,10 @@ async function planOperations(
     if (!source.file.exists) throw new Error(`Cannot update missing file '${hunk.path}'.`);
     if (source.file.isDirectory || !source.file.isFile) throw new Error(`Cannot update non-file '${hunk.path}'.`);
     const original = await getVirtualContent(source.absolute, source.file);
-    const moveTo = hunk.moveTo ? resolvePatchPath(hunk.moveTo, cwd) : undefined;
-    if (moveTo === source.absolute) throw new Error(`Cannot move '${hunk.path}' onto itself.`);
-
     let destination: { absolute: string; file: VirtualFile } | undefined;
-    if (moveTo) {
+    if (hunk.moveTo) {
       destination = await getVirtualFile(hunk.moveTo!);
+      if (destination.absolute === source.absolute) throw new Error(`Cannot move '${hunk.path}' onto itself.`);
       if (destination.file.isDirectory || (destination.file.exists && !destination.file.isFile)) {
         throw new Error(`Cannot move file over non-file '${hunk.moveTo}'.`);
       }
@@ -415,17 +326,21 @@ async function planOperations(
 
     const content = applyUpdateContent(original, hunk.chunks, hunk.path);
     if (destination) {
+      // A move copies the referent's content, then unlinks the source entry.
+      // Moving a symlink must not delete its referent.
+      const sourceEntry = await getVirtualFile(hunk.path, false);
       operations.push({
         kind: "update",
-        path: source.absolute,
-        displayPath: displayPath(cwd, source.absolute, hunk.path),
-        moveTo: moveTo!,
-        moveDisplayPath: displayPath(cwd, moveTo!, hunk.moveTo!),
+        path: sourceEntry.absolute,
+        displayPath: sourceDisplay,
+        moveTo: destination.absolute,
+        moveDisplayPath: displayPath(cwd, resolvePatchPath(hunk.moveTo!, cwd), hunk.moveTo!),
         chunkGroups: [[...hunk.chunks]],
         content,
       });
-      source.file.exists = false;
-      source.file.content = undefined;
+      sourceEntry.file.exists = false;
+      sourceEntry.file.isSymbolicLink = false;
+      sourceEntry.file.content = undefined;
       destination.file.exists = true;
       destination.file.isDirectory = false;
       destination.file.isFile = true;
@@ -441,7 +356,7 @@ async function planOperations(
       operations.push({
         kind: "update",
         path: source.absolute,
-        displayPath: displayPath(cwd, source.absolute, hunk.path),
+        displayPath: sourceDisplay,
         chunkGroups: [[...hunk.chunks]],
         content,
       });
@@ -456,131 +371,58 @@ function resolvePatchPath(rawPath: string, cwd: string): string {
   return isAbsolute(rawPath) ? resolve(rawPath) : resolve(cwd, rawPath);
 }
 
-async function safePath(rawPath: string, cwd: string, signal?: AbortSignal): Promise<SafePath> {
-  throwIfAborted(signal);
-  const absolute = resolvePatchPath(rawPath, cwd);
-
-  let current = absolute;
-  let target: Omit<SafePath, "absolute"> = { exists: false, isDirectory: false, isFile: false };
-  while (true) {
+// Resolve aliases for preflight identity, including dangling links and missing
+// descendants. This is not a filesystem sandbox; I/O uses normal Node semantics.
+async function canonicalPath(
+  absolute: string,
+  followFinal = true,
+  virtualFiles = new Map<string, VirtualFile>(),
+  signal?: AbortSignal,
+): Promise<string> {
+  let links = 0;
+  let current = parse(absolute).root;
+  let pending = relative(current, absolute).split(sep).filter(Boolean);
+  while (pending.length > 0) {
     throwIfAborted(signal);
-    try {
-      const stats = await lstat(current);
-      if (stats.isSymbolicLink()) {
-        throw new Error(`Symlink paths are not allowed in apply_patch: ${rawPath}`);
-      }
-      if (current !== absolute && !stats.isDirectory()) {
-        throw new Error(`Parent path is not a directory: ${rawPath}`);
-      }
-      if (current === absolute) {
-        target = { exists: true, isDirectory: stats.isDirectory(), isFile: stats.isFile() };
-      }
-    } catch (error) {
-      if (!isMissingPathError(error)) throw error;
+    const component = pending.shift()!;
+    if (component === ".") continue;
+    if (component === "..") {
+      current = dirname(current);
+      continue;
     }
-    const parent = dirname(current);
-    if (parent === current) return { absolute, ...target };
-    current = parent;
-  }
-}
-
-function requireSecureFilesystem(): void {
-  if (!secureFilesystemSupported()) {
-    throw new Error("apply_patch requires a POSIX filesystem with descriptor-based no-follow support.");
-  }
-}
-
-async function openSecureRoot(root: string, signal?: AbortSignal): Promise<number> {
-  requireSecureFilesystem();
-  let current = await openFd(sep, SECURE_DIRECTORY_FLAGS, 0);
-  try {
-    for (const component of root.split(sep).filter(Boolean)) {
-      throwIfAborted(signal);
-      const next = await openSecureDirectoryChild(current, component);
-      await closeFd(current);
-      current = next;
+    current = join(current, component);
+    const file = virtualFiles.get(current) ?? await inspectPath(current);
+    if (file.isSymbolicLink && (followFinal || pending.length > 0)) {
+      if (++links > 40) throw new Error(`Too many symbolic links in patch path: ${absolute}`);
+      const target = await readlink(current);
+      const root = parse(target).root;
+      current = root || dirname(current);
+      // Do not normalize '..' in a link's stored target before following any
+      // earlier links: the OS applies it to the resolved directory.
+      pending = [...target.slice(root.length).split(sep).filter(Boolean), ...pending];
+    } else if (pending.length > 0 && file.exists && !file.isDirectory) {
+      throw new Error(`Parent path is not a directory: ${absolute}`);
     }
-    return current;
-  } catch (error) {
-    await closeFd(current).catch(() => undefined);
-    throw error;
   }
+  return current;
 }
 
-async function openSecureDirectoryChild(parentFd: number, component: string): Promise<number> {
-  const fd = await openChildRelative(parentFd, component, SECURE_DIRECTORY_FLAGS, 0);
+async function inspectPath(absolute: string): Promise<VirtualFile> {
   try {
-    if (!(await fstatFd(fd)).isDirectory()) throw new Error(`Secure path component is not a directory: ${component}`);
-    return fd;
+    const stats = await lstat(absolute);
+    return { exists: true, isDirectory: stats.isDirectory(), isFile: stats.isFile(), isSymbolicLink: stats.isSymbolicLink() };
   } catch (error) {
-    await closeFd(fd).catch(() => undefined);
-    throw error;
+    if (!isMissingPathError(error)) throw error;
+    return { exists: false, isDirectory: false, isFile: false };
   }
 }
 
-type SecureParent = { handle: number; owned: boolean };
-
-async function openSecureParentDirectory(rootFd: number, root: string, absolute: string, createParents: boolean, signal?: AbortSignal): Promise<SecureParent> {
-  const parentPath = dirname(absolute);
-  const relativeParent = relative(root, parentPath);
-  const components = relativeParent ? relativeParent.split(sep) : [];
-  if (components.some((component) => !component || component === "." || component === "..")) {
-    throw new Error(`Patch path cannot be traversed securely: ${absolute}`);
-  }
-
-  let current = rootFd;
-  let owned = false;
-  try {
-    for (const component of components) {
-      throwIfAborted(signal);
-      let next: number;
-      try {
-        next = await openSecureDirectoryChild(current, component);
-      } catch (error) {
-        if (!createParents || !isNoEntryError(error)) throw error;
-        try {
-          await mkdirChildRelative(current, component, 0o777);
-        } catch (mkdirError) {
-          if (!isAlreadyExistsError(mkdirError)) throw mkdirError;
-        }
-        next = await openSecureDirectoryChild(current, component);
-      }
-      if (owned) await closeFd(current);
-      current = next;
-      owned = true;
-    }
-    return { handle: current, owned };
-  } catch (error) {
-    if (owned) await closeFd(current).catch(() => undefined);
-    throw error;
-  }
-}
-
-async function withSecureFile<T>(
-  rootFd: number,
-  root: string,
-  absolute: string,
-  flags: number,
-  createParents: boolean,
-  callback: (fd: number, size: number) => Promise<T>,
-  signal?: AbortSignal,
-): Promise<T> {
-  const parent = await openSecureParentDirectory(rootFd, root, absolute, createParents, signal);
-  let fd: number | undefined;
+async function readTargetFile(absolute: string, signal?: AbortSignal): Promise<string> {
+  const file = await open(absolute, constants.O_RDONLY | (constants.O_NONBLOCK ?? 0));
   try {
-    fd = await openChildRelative(parent.handle, basename(absolute), flags, 0o666);
-    const stats = await fstatFd(fd);
+    const stats = await file.stat();
     if (!stats.isFile()) throw new Error(`Patch target is not a regular file: ${absolute}`);
-    return await callback(fd, stats.size);
-  } finally {
-    if (fd !== undefined) await closeFd(fd).catch(() => undefined);
-    if (parent.owned) await closeFd(parent.handle).catch(() => undefined);
-  }
-}
-
-async function readSecureFile(rootFd: number, root: string, absolute: string, signal?: AbortSignal): Promise<string> {
-  return withSecureFile(rootFd, root, absolute, SECURE_READ_FLAGS, false, async (fd, size) => {
-    if (size > MAX_TARGET_FILE_BYTES) {
+    if (stats.size > MAX_TARGET_FILE_BYTES) {
       throw new Error(`Patch target exceeds the ${MAX_TARGET_FILE_BYTES}-byte limit: ${absolute}`);
     }
 
@@ -589,7 +431,7 @@ async function readSecureFile(rootFd: number, root: string, absolute: string, si
     while (true) {
       throwIfAborted(signal);
       const buffer = Buffer.alloc(Math.min(FILE_READ_CHUNK_BYTES, MAX_TARGET_FILE_BYTES + 1 - total));
-      const bytesRead = await readFd(fd, buffer, 0, buffer.length, null);
+      const { bytesRead } = await file.read(buffer, 0, buffer.length, null);
       if (bytesRead === 0) break;
       total += bytesRead;
       chunks.push(buffer.subarray(0, bytesRead));
@@ -598,31 +440,20 @@ async function readSecureFile(rootFd: number, root: string, absolute: string, si
       }
     }
     return Buffer.concat(chunks, total).toString("utf8");
-  }, signal);
-}
-
-async function writeSecureFile(rootFd: number, root: string, absolute: string, content: string, createParents: boolean, signal?: AbortSignal): Promise<void> {
-  const flags = createParents ? SECURE_CREATE_FLAGS : SECURE_UPDATE_FLAGS;
-  await withSecureFile(rootFd, root, absolute, flags, createParents, async (fd) => {
-    await writeAllFd(fd, content);
-  }, signal);
-}
-
-async function removeSecureFile(rootFd: number, root: string, absolute: string, signal?: AbortSignal): Promise<void> {
-  const parent = await openSecureParentDirectory(rootFd, root, absolute, false, signal);
-  try {
-    throwIfAborted(signal);
-    // No-follow stat without opening the target, so unreadable (mode-000) files can still be deleted;
-    // unlink only requires write permission on the parent directory, never on the file itself.
-    const stats = await lstatChildRelative(parent.handle, basename(absolute));
-    if (stats.isSymbolicLink) throw new Error(`Symlink paths are not allowed in apply_patch: ${absolute}`);
-    if (stats.isDirectory) throw new Error(`Cannot delete directory '${absolute}'.`);
-    await unlinkChildRelative(parent.handle, basename(absolute));
   } finally {
-    if (parent.owned) await closeFd(parent.handle).catch(() => undefined);
+    await file.close();
   }
 }
 
+async function writeTargetFile(absolute: string, content: string, signal?: AbortSignal): Promise<void> {
+  throwIfAborted(signal);
+  await mkdir(dirname(absolute), { recursive: true });
+  throwIfAborted(signal);
+  // Match Pi write: follow symlinks and retain the mutation lock until I/O settles.
+  await writeFile(absolute, content, "utf8");
+  throwIfAborted(signal);
+}
+
 function applyUpdateContent(original: string, chunks: UpdateChunk[], displayPath: string): string {
   const bom = original.startsWith("\uFEFF") ? "\uFEFF" : "";
   const body = bom ? original.slice(1) : original;
@@ -713,7 +544,9 @@ function normalizePunctuation(value: string): string {
 }
 
 async function withMutationLocks<T>(paths: string[], callback: () => Promise<T>): Promise<T> {
-  const uniquePaths = [...new Set(paths)].sort();
+  // Pi also canonicalizes queue keys. Deduplicate aliases before nesting queues,
+  // or two names for one file would attempt to acquire the same lock twice.
+  const uniquePaths = [...new Set(await Promise.all(paths.map((path) => canonicalPath(path))))].sort();
   const acquire = (index: number): Promise<T> =>
     index === uniquePaths.length ? callback() : withFileMutationQueue(uniquePaths[index], () => acquire(index + 1));
   return acquire(0);
@@ -728,14 +561,6 @@ function isMissingPathError(error: unknown): boolean {
   return typeof error === "object" && error !== null && "code" in error && (error.code === "ENOENT" || error.code === "ENOTDIR");
 }
 
-function isNoEntryError(error: unknown): boolean {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
-}
-
-function isAlreadyExistsError(error: unknown): boolean {
-  return typeof error === "object" && error !== null && "code" in error && error.code === "EEXIST";
-}
-
 function throwIfAborted(signal: AbortSignal | undefined): void {
   if (signal?.aborted) throw new Error("Operation aborted");
 }

package/native/addon.c

@@ -1,161 +0,0 @@
-// Native POSIX *at bindings for descriptor-relative filesystem walks.
-// Used by apply_patch on platforms without /proc/self/fd (macOS) to keep the
-// same TOCTOU-safe, no-follow directory walk that Linux gets via procfs.
-#include <node_api.h>
-#include <fcntl.h>
-#include <sys/stat.h>
-#include <unistd.h>
-#include <stdlib.h>
-#include <errno.h>
-#include <string.h>
-
-static napi_value throw_errno(napi_env env, int err) {
-  const char *code = NULL;
-  switch (err) {
-    case ENOENT: code = "ENOENT"; break;
-    case EEXIST: code = "EEXIST"; break;
-    case ELOOP: code = "ELOOP"; break;
-    case ENOTDIR: code = "ENOTDIR"; break;
-    case EACCES: code = "EACCES"; break;
-    case EISDIR: code = "EISDIR"; break;
-    case ENAMETOOLONG: code = "ENAMETOOLONG"; break;
-    case EINVAL: code = "EINVAL"; break;
-  }
-  napi_value msg, errv;
-  if (napi_create_string_utf8(env, strerror(err), NAPI_AUTO_LENGTH, &msg) != napi_ok ||
-      napi_create_error(env, NULL, msg, &errv) != napi_ok) {
-    napi_throw_error(env, NULL, strerror(err));
-    return NULL;
-  }
-  if (code) {
-    napi_value codev;
-    napi_create_string_utf8(env, code, NAPI_AUTO_LENGTH, &codev);
-    napi_set_named_property(env, errv, "code", codev);
-  }
-  napi_value enov;
-  napi_create_int32(env, err, &enov);
-  napi_set_named_property(env, errv, "errno", enov);
-  napi_throw(env, errv);
-  return NULL;
-}
-
-static char *get_string(napi_env env, napi_value v) {
-  size_t len = 0;
-  if (napi_get_value_string_utf8(env, v, NULL, 0, &len) != napi_ok) return NULL;
-  char *buf = (char *)malloc(len + 1);
-  if (!buf) return NULL;
-  size_t written = 0;
-  if (napi_get_value_string_utf8(env, v, buf, len + 1, &written) != napi_ok) { free(buf); return NULL; }
-  return buf;
-}
-
-static napi_value OpenAt(napi_env env, napi_callback_info info) {
-  size_t argc = 4;
-  napi_value args[4];
-  if (napi_get_cb_info(env, info, &argc, args, NULL, NULL) != napi_ok || argc < 3) {
-    napi_throw_type_error(env, NULL, "openat(dirfd, path, flags[, mode]) requires (dirfd, path, flags)");
-    return NULL;
-  }
-  int dirfd = 0, flags = 0, mode = 0;
-  if (napi_get_value_int32(env, args[0], &dirfd) != napi_ok ||
-      napi_get_value_int32(env, args[2], &flags) != napi_ok) {
-    napi_throw_type_error(env, NULL, "dirfd and flags must be integers");
-    return NULL;
-  }
-  char *path = get_string(env, args[1]);
-  if (!path) { napi_throw_type_error(env, NULL, "path must be a string"); return NULL; }
-  if (argc >= 4 && napi_get_value_int32(env, args[3], &mode) != napi_ok) {
-    free(path); napi_throw_type_error(env, NULL, "mode must be an integer"); return NULL;
-  }
-  int fd = openat(dirfd, path, flags, (mode_t)mode);
-  int saved_errno = errno;
-  free(path);
-  if (fd < 0) return throw_errno(env, saved_errno);
-  napi_value result;
-  napi_create_int32(env, fd, &result);
-  return result;
-}
-
-static napi_value MkdirAt(napi_env env, napi_callback_info info) {
-  size_t argc = 3;
-  napi_value args[3];
-  if (napi_get_cb_info(env, info, &argc, args, NULL, NULL) != napi_ok || argc < 2) {
-    napi_throw_type_error(env, NULL, "mkdirat(dirfd, path[, mode]) requires (dirfd, path)");
-    return NULL;
-  }
-  int dirfd = 0, mode = 0777;
-  if (napi_get_value_int32(env, args[0], &dirfd) != napi_ok) { napi_throw_type_error(env, NULL, "dirfd must be an integer"); return NULL; }
-  char *path = get_string(env, args[1]);
-  if (!path) { napi_throw_type_error(env, NULL, "path must be a string"); return NULL; }
-  if (argc >= 3 && napi_get_value_int32(env, args[2], &mode) != napi_ok) { free(path); napi_throw_type_error(env, NULL, "mode must be an integer"); return NULL; }
-  int rc = mkdirat(dirfd, path, (mode_t)mode);
-  int saved_errno = errno;
-  free(path);
-  if (rc < 0) return throw_errno(env, saved_errno);
-  napi_value undef;
-  napi_get_undefined(env, &undef);
-  return undef;
-}
-
-static napi_value UnlinkAt(napi_env env, napi_callback_info info) {
-  size_t argc = 2;
-  napi_value args[2];
-  if (napi_get_cb_info(env, info, &argc, args, NULL, NULL) != napi_ok || argc < 2) {
-    napi_throw_type_error(env, NULL, "unlinkat(dirfd, path) requires (dirfd, path)");
-    return NULL;
-  }
-  int dirfd = 0;
-  if (napi_get_value_int32(env, args[0], &dirfd) != napi_ok) { napi_throw_type_error(env, NULL, "dirfd must be an integer"); return NULL; }
-  char *path = get_string(env, args[1]);
-  if (!path) { napi_throw_type_error(env, NULL, "path must be a string"); return NULL; }
-  int rc = unlinkat(dirfd, path, 0);
-  int saved_errno = errno;
-  free(path);
-  if (rc < 0) return throw_errno(env, saved_errno);
-  napi_value undef;
-  napi_get_undefined(env, &undef);
-  return undef;
-}
-
-static napi_value LstatAt(napi_env env, napi_callback_info info) {
-  size_t argc = 2;
-  napi_value args[2];
-  if (napi_get_cb_info(env, info, &argc, args, NULL, NULL) != napi_ok || argc < 2) {
-    napi_throw_type_error(env, NULL, "lstatAt(dirfd, path) requires (dirfd, path)");
-    return NULL;
-  }
-  int dirfd = 0;
-  if (napi_get_value_int32(env, args[0], &dirfd) != napi_ok) {
-    napi_throw_type_error(env, NULL, "dirfd must be an integer");
-    return NULL;
-  }
-  char *path = get_string(env, args[1]);
-  if (!path) {
-    napi_throw_type_error(env, NULL, "path must be a string");
-    return NULL;
-  }
-  struct stat st;
-  int rc = fstatat(dirfd, path, &st, AT_SYMLINK_NOFOLLOW);
-  int saved_errno = errno;
-  free(path);
-  if (rc < 0) return throw_errno(env, saved_errno);
-  napi_value obj, v;
-  napi_create_object(env, &obj);
-  napi_get_boolean(env, S_ISREG(st.st_mode), &v); napi_set_named_property(env, obj, "isFile", v);
-  napi_get_boolean(env, S_ISDIR(st.st_mode), &v); napi_set_named_property(env, obj, "isDirectory", v);
-  napi_get_boolean(env, S_ISLNK(st.st_mode), &v); napi_set_named_property(env, obj, "isSymbolicLink", v);
-  return obj;
-}
-
-static napi_value Init(napi_env env, napi_value exports) {
-  const napi_property_descriptor props[] = {
-    { "openat", NULL, OpenAt, NULL, NULL, NULL, napi_default, NULL },
-    { "mkdirat", NULL, MkdirAt, NULL, NULL, NULL, napi_default, NULL },
-    { "unlinkat", NULL, UnlinkAt, NULL, NULL, NULL, napi_default, NULL },
-    { "lstatAt", NULL, LstatAt, NULL, NULL, NULL, napi_default, NULL },
-  };
-  napi_define_properties(env, exports, 4, props);
-  return exports;
-}
-
-NAPI_MODULE(NODE_GYP_MODULE_NAME, Init)

package/src/native.ts

@@ -1,40 +0,0 @@
-import { createRequire } from "node:module";
-import { dirname } from "node:path";
-import { fileURLToPath } from "node:url";
-
-/**
- * POSIX *at bindings for descriptor-relative filesystem walks. macOS has no
- * procfs, so the TOCTOU-safe walk used by apply_patch (open each directory
- * component relative to a trusted parent fd with O_NOFOLLOW) needs openat /
- * mkdirat / unlinkat. Node does not expose these, so a tiny N-API addon
- * provides them on darwin. Linux keeps its /proc/self/fd path and never loads
- * this binding.
- */
-export interface OpenAtBindings {
-  openat(dirfd: number, path: string, flags: number, mode: number): number;
-  mkdirat(dirfd: number, path: string, mode: number): void;
-  unlinkat(dirfd: number, path: string): void;
-  lstatAt(dirfd: number, path: string): { isFile: boolean; isDirectory: boolean; isSymbolicLink: boolean };
-}
-
-let cached: OpenAtBindings | null | undefined;
-
-/** Returns the native *at bindings on darwin, or null on any other platform / load failure. */
-export function getOpenAtBindings(): OpenAtBindings | null {
-  if (cached !== undefined) return cached;
-  if (process.platform !== "darwin") {
-    cached = null;
-    return null;
-  }
-  try {
-    const require = createRequire(import.meta.url);
-    const resolveBinding = require("node-gyp-build") as (dir: string) => unknown;
-    // native.ts lives in src/; the binding (build/ or prebuilds/) ships at the package root.
-    const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
-    const addon = resolveBinding(packageRoot) as OpenAtBindings;
-    cached = typeof addon?.openat === "function" ? addon : null;
-  } catch {
-    cached = null;
-  }
-  return cached;
-}