pi-python-helper 0.4.1 → 0.4.3

package/CHANGELOG.md

@@ -7,6 +7,22 @@ does not guarantee a stable public tool schema.
 
 ## [Unreleased]
 
+## [0.4.3] - 2026-09-21
+
+### Fixed
+
+- A project named through `path` now runs `uv` and `pytest` in the resolved project root instead of `ctx.cwd`. `py_sync`, `py_test`, `py_test_select`, `py_validation_bundle`, and `py_tdd_checkpoint` previously generated and executed their commands in the session directory, so a project reached through `path` failed with "No `pyproject.toml` found in current directory" or ran the wrong tests.
+
+### Added
+
+- `py_tdd_checkpoint` accepts an optional `path` for git discovery.
+
+## [0.4.2] - 2026-09-21
+
+### Removed
+
+- `src/core/safety.ts` is gone. The tools gate state changes with an explicit `execute: true`, so the Python risk classifier had no production caller and was maintained dead code. The expected classification of Python commands is kept as an executable spec in `test/core.test.ts`, exercised against `pi-helper-core`'s classifier.
+
 ## [0.4.1] - 2026-09-21
 
 ### Changed

package/docs/tools.md

@@ -415,6 +415,7 @@ Check whether production Python changes have related test changes before impleme
 | 파라미터 | 타입 | 필수 | 설명 |
 |---|---|---|---|
 | `changedPaths` | `array<string>` | 아니오 | maxItems 500 |
+| `path` | `string` | 아니오 | — |
 | `testChangedPaths` | `array<string>` | 아니오 | maxItems 500 |
 
 **프롬프트 가이드라인**

package/extensions/tools/testing.ts

@@ -89,7 +89,7 @@ export function registerTestingTools(pi: Pi): void {
         let changed = params.changedPaths ?? [];
         let changedSource = 'argument';
         if (!changed.length) {
-          const discovered = await changedPaths(ctx.cwd, signal);
+          const discovered = await changedPaths(root, signal);
           changed = discovered.paths;
           changedSource = discovered.source === 'git' ? 'git' : (discovered.error ?? 'none');
         }
@@ -109,7 +109,7 @@ export function registerTestingTools(pi: Pi): void {
             (entry) => isRunnableTestFile(entry.path) || basename(entry.path) === 'conftest.py',
           )
           .map((entry) => entry.path);
-        const command = pytestCommand(ctx.cwd, {
+        const command = pytestCommand(root, {
           targets: selection.fellBackToAll ? [] : targets,
         });
 
@@ -232,7 +232,7 @@ export function registerTestingTools(pi: Pi): void {
       const started = Date.now();
       try {
         const root = (await resolveProjectRoot(ctx.cwd, params.path)) ?? ctx.cwd;
-        const command = pytestCommand(ctx.cwd, {
+        const command = pytestCommand(root, {
           targets: params.targets,
           lastFailed: params.lastFailed,
           keyword: params.keyword,
@@ -261,7 +261,7 @@ export function registerTestingTools(pi: Pi): void {
         }
 
         const run = await runCommand(command.executable, command.args, {
-          cwd: ctx.cwd,
+          cwd: root,
           signal,
           timeoutMs: (params.timeoutSeconds ?? 900) * 1000,
           maxBytes: 512 * 1024,

package/extensions/tools/validation.ts

@@ -73,7 +73,7 @@ export function registerValidationTools(pi: Pi): void {
         const root = (await resolveProjectRoot(ctx.cwd, params.path)) ?? ctx.cwd;
         const mode = params.mode ?? 'check';
         const extras = params.extras ?? 'all';
-        const command = mode === 'check' ? uvLockCheck(ctx.cwd) : uvSyncFrozen(ctx.cwd, { extras });
+        const command = mode === 'check' ? uvLockCheck(root) : uvSyncFrozen(root, { extras });
         const lockPresent = await isFile(join(root, 'uv.lock'));
 
         if (!params.execute) {
@@ -109,7 +109,7 @@ export function registerValidationTools(pi: Pi): void {
         }
 
         const run = await runCommand(command.executable, command.args, {
-          cwd: ctx.cwd,
+          cwd: root,
           signal,
           timeoutMs: (params.timeoutSeconds ?? 600) * 1000,
           maxBytes: 256 * 1024,
@@ -296,9 +296,9 @@ export function registerValidationTools(pi: Pi): void {
       try {
         const root = (await resolveProjectRoot(ctx.cwd, params.path)) ?? ctx.cwd;
         const lockPresent = await isFile(join(root, 'uv.lock'));
-        const lock = uvLockCheck(ctx.cwd);
-        const sync = uvSyncFrozen(ctx.cwd);
-        const test = pytestCommand(ctx.cwd, { targets: params.targets });
+        const lock = uvLockCheck(root);
+        const sync = uvSyncFrozen(root);
+        const test = pytestCommand(root, { targets: params.targets });
         const timeoutMs = (params.timeoutSeconds ?? 1800) * 1000;
         const runQuality = params.quality ?? true;
 
@@ -317,7 +317,7 @@ export function registerValidationTools(pi: Pi): void {
               toolConfiguration: manifestScan.payload?.manifest?.toolConfiguration,
             })
           : [];
-        const quality = qualityCommands(ctx.cwd, runners);
+        const quality = qualityCommands(root, runners);
         const commands = [lock, sync, test, ...quality];
 
         if (!params.execute) {
@@ -369,14 +369,14 @@ export function registerValidationTools(pi: Pi): void {
 
         const lockRun = lockPresent
           ? await runCommand(lock.executable, lock.args, {
-              cwd: ctx.cwd,
+              cwd: root,
               signal,
               timeoutMs,
               maxBytes: 256 * 1024,
             })
           : undefined;
         const syncRun = await runCommand(sync.executable, sync.args, {
-          cwd: ctx.cwd,
+          cwd: root,
           signal,
           timeoutMs,
           maxBytes: 256 * 1024,
@@ -400,7 +400,7 @@ export function registerValidationTools(pi: Pi): void {
 
         const testRun = syncOk
           ? await runCommand(test.executable, test.args, {
-              cwd: ctx.cwd,
+              cwd: root,
               signal,
               timeoutMs,
               maxBytes: 512 * 1024,
@@ -466,7 +466,7 @@ export function registerValidationTools(pi: Pi): void {
           }
           const preview = quality[index];
           const run = await runCommand(preview.executable, preview.args, {
-            cwd: ctx.cwd,
+            cwd: root,
             signal,
             timeoutMs,
             maxBytes: 256 * 1024,
@@ -615,14 +615,16 @@ export function registerValidationTools(pi: Pi): void {
     parameters: Type.Object({
       changedPaths: Type.Optional(Type.Array(Type.String(), { maxItems: 500 })),
       testChangedPaths: Type.Optional(Type.Array(Type.String(), { maxItems: 500 })),
+      path: Type.Optional(Type.String()),
     }),
     async execute(_id, params, signal, _update, ctx) {
       const started = Date.now();
+      const root = (await resolveProjectRoot(ctx.cwd, params.path)) ?? ctx.cwd;
       let changedPaths = params.changedPaths ?? [];
       let source = 'argument';
       if (!changedPaths.length) {
         const diff = await runCommand('git', ['diff', '--name-only', 'HEAD'], {
-          cwd: ctx.cwd,
+          cwd: root,
           signal,
           timeoutMs: 10000,
           maxBytes: 100_000,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-python-helper",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Python (uv) development tools for the pi coding agent",
   "type": "module",
   "keywords": [

package/src/core/safety.ts

@@ -1,109 +0,0 @@
-/**
- * Python's risk rules for the shared classifier.
- *
- * Python has no equivalent of a `cmd_vel` topic that deterministically signals
- * actuation, so risk is read from the command text. Segment splitting, safe
- * override precedence, and the compound-command merge live in
- * `pi-helper-core`; this module supplies only the package-manager, environment,
- * and migration rules that are specific to Python. The universal rules (git
- * history, file deletion, destructive SQL, containers, pipe-to-shell) are
- * applied by the core and must not be repeated here.
- */
-import {
-  classifyCommand as coreClassifyCommand,
-  isMutatingCommand as coreIsMutatingCommand,
-  riskOf as coreRiskOf,
-  type CommandRisk,
-  type RiskRule,
-  type SafetyRules,
-} from 'pi-helper-core';
-
-export { splitCommandSegments } from 'pi-helper-core';
-export type { CommandClassification, CommandRisk } from 'pi-helper-core';
-
-/**
- * Safe overrides are matched before risk patterns so a read-only form does not
- * inherit the risk of the command it qualifies. Only the Python-specific
- * read-only forms live here; `--check`, `--dry-run`, and `--collect-only` are
- * already universal overrides in the core.
- */
-const PYTHON_SAFE_OVERRIDES: RegExp[] = [
-  /\buv\s+(?:tree|export|version|help)\b/,
-  /\buv\s+pip\s+(?:list|freeze|check)\b/,
-  /\bruff\s+(?:check|format)\b[^&|;]*(?:--diff|--check|--no-cache)\b/,
-  /\bmypy\b[^&|;]*--no-incremental\b/,
-];
-
-const PYTHON_RISK_PATTERNS: RiskRule[] = [
-  // Irreversible: cannot be undone by a local revert.
-  {
-    risk: 'irreversible',
-    pattern: /\b(?:uv|poetry|flit|hatch)\s+publish\b|\btwine\s+upload\b/,
-    reason: 'Publishing to a package index is public and cannot be retracted.',
-  },
-  {
-    risk: 'irreversible',
-    pattern: /\b(?:conda|mamba)\s+env\s+remove\b|\bconda\s+remove\b[^&|;]*--all\b/,
-    reason: 'Removing an environment destroys installed state.',
-  },
-  {
-    risk: 'irreversible',
-    pattern: /\b(?:alembic|manage\.py)\b[^&|;]*(?:downgrade|\bzero\b)/,
-    reason: 'Reversing a database migration can drop data.',
-  },
-
-  // Mutating: changes project, environment, or remote state but is recoverable.
-  {
-    risk: 'mutating',
-    pattern: /\b(?:uv|pdm|poetry)\s+(?:add|remove|sync|lock|update|venv)\b/,
-    reason: 'Modifies the environment or the lockfile.',
-  },
-  {
-    risk: 'mutating',
-    pattern: /\buv\s+pip\s+(?:install|uninstall|sync)\b/,
-    reason: 'Changes installed packages in the active environment.',
-  },
-  {
-    risk: 'mutating',
-    pattern: /\b(?:pip|pip3)\s+(?:install|uninstall)\b/,
-    reason: 'Changes installed packages in the active environment.',
-  },
-  {
-    risk: 'mutating',
-    pattern: /\b(?:conda|mamba)\s+(?:install|create|update|remove)\b/,
-    reason: 'Changes conda environment state.',
-  },
-  {
-    risk: 'mutating',
-    pattern: /\b(?:alembic|manage\.py)\b[^&|;]*\b(?:upgrade|migrate|makemigrations)\b/,
-    reason: 'Applies a schema change to a database.',
-  },
-  {
-    risk: 'mutating',
-    pattern: /\bpre-commit\s+(?:install|autoupdate|run|clean)\b/,
-    reason: 'Rewrites hook configuration or working tree files.',
-  },
-];
-
-const PYTHON_RULES: Partial<SafetyRules> = {
-  safeOverrides: PYTHON_SAFE_OVERRIDES,
-  patterns: PYTHON_RISK_PATTERNS,
-};
-
-/**
- * Classify a shell command by the highest risk of its segments. Used to warn
- * before a tool runs something that cannot be undone, and to gate this
- * package's own environment-modifying commands behind explicit opt-in.
- */
-export function classifyCommand(command: string): import('pi-helper-core').CommandClassification {
-  return coreClassifyCommand(command, PYTHON_RULES);
-}
-
-export function isMutatingCommand(command: string): boolean {
-  return coreIsMutatingCommand(command, PYTHON_RULES);
-}
-
-/** Commands that this package runs itself always carry a known risk class. */
-export function riskOf(args: string[]): CommandRisk {
-  return coreRiskOf(args, PYTHON_RULES);
-}