pi-shorthand 0.3.0 → 0.3.2

package/README.md

@@ -1,93 +1,33 @@
 # pi-shorthand
 
-![A code call in Pi: the verdict, then the diff it applied, then the program's output](https://raw.githubusercontent.com/sebinsua/pi-shorthand/main/docs/screenshot.png?v=2)
+![A code call in Pi](https://raw.githubusercontent.com/sebinsua/pi-shorthand/main/docs/screenshot.png?v=2)
 
 A [Pi](https://github.com/earendil-works/pi) tool for editing repositories with Bun programs.
-The model can combine ordinary JavaScript, text edits and structural transformations in one call.
-
-The program sees your repo as normal, but its writes are held back. By default, they're applied only
-if the program succeeds and destination files are unchanged, and the model gets the diff.
-The program performs the edit; tests, type-checks and other verification run separately afterward.
 
 ## Install
 
+Install pi-shorthand and initialize Grit:
+
 ```sh
 pi install npm:pi-shorthand
+npx @getgrit/cli init --global
 ```
 
-Or from GitHub (`pi install git:github.com/sebinsua/pi-shorthand`), or a local clone: `npm install`, then `pi install /path/to/pi-shorthand`.
-
-A project install (`pi install -l`) only loads once you trust the project: Pi asks, or run `pi --approve`.
-
-You also need Bun, git, and either [bubblewrap](https://github.com/containers/bubblewrap) 0.9+
-(Linux) or [AgentFS](https://github.com/tursodatabase/agentfs) and `clang` (macOS:
-`curl -fsSL https://agentfs.ai/install | bash`).
+On macOS, install clang and AgentFS:
 
-## What a program can use
-
-Anything in Bun or Node, plus these globals (no imports):
-
-```ts
-await $`git ls-files`.text(); // Bun's shell (the only async one)
-glob("src/**/*.ts"); // → ["src/a.ts", …]
-grep("oldApi(", "src"); // → [{ file, line, text }, …]
-sg.find("oldApi($$$ARGS)", "src"); // ast-grep search
-sg.rewrite("oldApi($$$ARGS)", "newApi($$$ARGS)", "src");
-sg.insert("initialize();", { before: sg.one("run();", "src/app.ts") });
-sg.move(sg.one("function helper() { $$$BODY }", "src/old.ts"), { endOf: sg.file("src/new.ts") });
-sg.remove(sg.one("obsolete();", "src/app.ts"));
-sg.parse(sg.Lang.TypeScript, source); // ast-grep's own API (or import from "@ast-grep/napi")
-grit("`console.log($x)` => `logger.info($x)`", "src");
+```sh
+xcode-select --install
+curl -fsSL https://agentfs.ai/install | bash
 ```
 
-`sg.find`, `sg.one`, `sg.rewrite` and `grit` also accept `sg.file("src/app.ts")` directly, including
-in arrays mixed with paths. Search reads the file's current contents. Missing targets are valid insertion
-destinations but cannot be searched. An explicit target can select an ignored file inside the workspace;
-the tool still only applies Git-visible changes.
+On Linux, install bubblewrap 0.9 or later. For Debian and Ubuntu:
 
-[api.d.ts](api.d.ts) exposes the actual injected helper types for editor completion and external TypeScript
-checking of editing programs. Include it in the program's TypeScript project (or reference
-`pi-shorthand/api` via `compilerOptions.types` when installed as a package). This supplies types, not runtime
-globals. Bun execution does not automatically type-check programs or run application verification.
-
-## Options
-
-- `title`: a short description shown with the call (required).
-- `rollback`: `"all"` (default) applies nothing if the program fails. After a timeout, `"file"`
-  keeps changed files that were no longer open for writing if writer inspection succeeds. Other
-  failures apply nothing because open writers cannot be identified after the process exits.
-- `timeout`: seconds before the program is killed. Default 2.
-
-## Good to know
-
-- Only files git tracks, or would track, are applied.
-- Successful edits are formatted with detected installed project tools (Prettier, oxfmt, Biome, Ruff,
-  Black, gofmt or rustfmt) before the final diff. Ambiguous setups are skipped; formatter failures warn
-  without discarding completed edits. Set `PI_SHORTHAND_FORMAT=0` to disable. No project config is required.
-- Each run snapshots the checkout first; reflinks make that cheap where supported, while other
-  filesystems copy its contents and use corresponding temporary space. On macOS the program runs at
-  a private AgentFS mount, so use paths relative to its working directory for repository files.
-- Runs against the same checkout are serialized. If another process edits a destination while a run
-  is in progress, shorthand checks it again immediately before replacing it and reports a conflict.
-  A non-cooperating writer can still race the final filesystem rename or removal itself.
-- To try it with only `read` and `code`: `pi --tools read,code`.
-- Run history is stored in `~/.cache/pi-shorthand/runs.jsonl` with directory mode `0700` and file
-  mode `0600`. It records timestamps, opaque run IDs, lifecycle events, exit status, durations,
-  counts, helper names, and shell executable names. It does not record programs, output, errors,
-  arguments, repository paths, file paths, or diffs. The log rotates at 1 MiB and expires after
-  seven days. Set `PI_SHORTHAND_HISTORY=0` to disable it. To watch enabled history:
-  `tail -f ~/.cache/pi-shorthand/runs.jsonl`.
-
-## Developing
+```sh
+sudo apt install bubblewrap
+```
 
-`npm run check` type-checks (TypeScript 7), lints (oxlint) and checks formatting (oxfmt). A pre-commit
-hook runs it; `npm run format` fixes formatting.
+## Technical choices
 
-`npm test` runs the tests against real overlays (it needs AgentFS on macOS, bubblewrap on Linux).
-`test/linux.sh` runs them on Linux in Docker.
+pi-shorthand gives Pi a programming environment instead of a patch format. This makes multi-file and structural edits possible in one call, but does not guarantee that Pi will find it easier or more reliable than its built-in edit tool. Which works better depends on the model and the task.
 
-`bun e2e/suite.ts` previews the local benchmark suite without calling a model. Add `--execute` to run it.
-The [comparison harness](e2e/README.md) supports stock, optional and replacement editing tools, controlled
-documentation/skills, independent task checks, saved final changes and session reports.
-`bun e2e/run.ts --repo <path or git URL> --task "…" --setups baseline,replace,code --check "…"` runs Pi
-with a real model on fresh copies of your own repository.
+Programs edit an isolated snapshot, with host files outside the repository kept read-only. By default, a failure keeps completed files and rolls back files involved in failed or interrupted edits; changes are applied only if their destination files have not changed. Progress is reported while a program runs, but no run history is written to disk.

package/display.ts

@@ -21,7 +21,7 @@ const LISTED_FILES = 8; // …showing this many, then "and N more files"
 const EXPANDED_DIFF_LINES = 2000; // even expanded, a diff of hundreds of files stops here
 
 export function callLine(args: { title?: string; timeout?: number; rollback?: string }, theme: Theme): string {
-	const settings = [args.rollback === "file" && "rollback per file", args.timeout && `timeout ${args.timeout}s`];
+	const settings = [args.rollback === "all" && "rollback all", args.timeout && `timeout ${args.timeout}s`];
 	const suffix = settings.filter(Boolean).join(", ");
 	return `${theme.fg("toolTitle", theme.bold("code"))} ${args.title ?? ""}${suffix ? theme.fg("muted", ` (${suffix})`) : ""}`;
 }
@@ -69,17 +69,16 @@ export function resultLines(run: RunResult, expanded: boolean, theme: Theme): st
 	}
 	for (const file of run.rolledBack) {
 		const reason = run.writerInspectionFailed
-			? "open writers could not be inspected at the timeout"
-			: run.timedOut
-				? "half-written when the program was killed"
-				: "finished writes unknown after the program exited";
+			? "open writers could not be inspected"
+			: "file edit failed or was interrupted";
 		lines.push(indent(theme.fg("warning", `rolled back ${file}: ${reason}`)));
 	}
 	for (const warning of [...run.warnings, ...printedWarnings]) lines.push(indent(theme.fg("warning", `⚠ ${warning}`)));
 
 	// The sections, each after a blank line.
 	const sections: string[][] = [];
-	const background: ToolBackground = run.exitCode === 0 && run.conflicts.length === 0 ? "toolSuccessBg" : "toolErrorBg";
+	const background: ToolBackground =
+		run.exitCode === 0 && run.conflicts.length === 0 && run.rolledBack.length === 0 ? "toolSuccessBg" : "toolErrorBg";
 	if (applied.length > 0) sections.push(diffLines(applied, expanded, theme, background));
 	if (output && (expanded || !error)) sections.push(outputLines(output, expanded, run.changes.length > 0, theme));
 	if (notApplied.length > 0) sections.push(notAppliedLines(notApplied, expanded, theme, background));
@@ -104,7 +103,7 @@ function verdict(run: RunResult, applied: FileChange[], theme: Theme): string {
 		return theme.fg("error", `✕ Conflict · ${application}${program}`) + took;
 	}
 	if (run.exitCode === 0 && run.changes.length === 0) return theme.fg("success", "✓ No changes") + took;
-	if (run.exitCode === 0) {
+	if (run.exitCode === 0 && run.rolledBack.length === 0) {
 		return theme.fg("success", `✓ Applied ${fileCount(applied)}`) + ` · ${stats(applied, theme)}` + took;
 	}
 	if (applied.length > 0) {

package/file-outcomes.ts

@@ -0,0 +1,100 @@
+/** Per-file edit outcomes sent to the runner over a private inherited descriptor. */
+import { spawnSync } from "node:child_process";
+import { realpathSync, writeSync } from "node:fs";
+import { isAbsolute, relative, resolve } from "node:path";
+
+export type FileOutcomeEvent =
+	| { type: "begin"; id: number; files: string[] }
+	| { type: "end" | "fail"; id: number }
+	| { type: "error"; files: string[] }
+	| { type: "writers"; files: string[] | null };
+
+const descriptor = process.env.PI_SHORTHAND_OUTCOMES_FD;
+const root = process.env.PI_SHORTHAND_EXECUTION_ROOT;
+const forceInspectionFailure = process.env.PI_SHORTHAND_INSPECTION_FAILURE === "1";
+// Subprocesses do not inherit descriptor 3 by default, so do not advertise it to them.
+delete process.env.PI_SHORTHAND_OUTCOMES_FD;
+delete process.env.PI_SHORTHAND_EXECUTION_ROOT;
+delete process.env.PI_SHORTHAND_INSPECTION_FAILURE;
+let nextId = 0;
+
+function send(event: FileOutcomeEvent): void {
+	if (!descriptor) return;
+	const bytes = Buffer.from(JSON.stringify(event) + "\n");
+	let offset = 0;
+	while (offset < bytes.length) offset += writeSync(Number(descriptor), bytes, offset);
+}
+
+function paths(files: readonly string[]): string[] {
+	if (!root) return [];
+	return [
+		...new Set(
+			files
+				.filter((file) => typeof file === "string")
+				.flatMap((file) => {
+					const absolute = resolve(file);
+					try {
+						return [relative(root, absolute), relative(root, realpathSync(absolute))];
+					} catch {
+						return [relative(root, absolute)];
+					}
+				}),
+		),
+	].filter((file) => file !== ".." && !file.startsWith("../") && !isAbsolute(file));
+}
+
+/** An operation may touch several files (for example, moving a node between files). */
+export function editingFiles<T>(files: readonly string[], edit: () => T): T {
+	if (!descriptor) return edit();
+	const id = nextId++;
+	send({ type: "begin", id, files: paths(files) });
+	try {
+		const result = edit();
+		send({ type: "end", id });
+		return result;
+	} catch (error) {
+		send({ type: "fail", id });
+		throw error;
+	}
+}
+
+export function installFileOutcomeTracking(): void {
+	if (!descriptor) return;
+	process.on("uncaughtExceptionMonitor", (error) => {
+		// Native filesystem errors identify their paths even when no editing helper was involved.
+		const details = (typeof error === "object" && error !== null ? error : {}) as { path?: unknown; dest?: unknown };
+		const files = [details.path, details.dest].filter((file): file is string => typeof file === "string");
+		send({ type: "error", files: paths(files) });
+	});
+	process.on("exit", (code) => {
+		if (code === 0) return;
+		send({ type: "writers", files: inspectWriters() });
+	});
+}
+
+/** Exit handlers run before descriptors close, so ordinary errors can be inspected too. */
+function inspectWriters(): string[] | null {
+	if (!root || forceInspectionFailure) return null;
+	// bubblewrap replaces /dev, hiding the host's message-queue mount. Exempt that unrelated
+	// mount from stat probes; otherwise lsof reports incomplete output for every Linux run.
+	const args = ["-n", "-P", "-F", "an", ...(process.platform === "linux" ? ["-e", "/dev/mqueue"] : [])];
+	const result = spawnSync("lsof", args, {
+		encoding: "utf8",
+		timeout: 2000,
+		maxBuffer: 64 * 1024 * 1024,
+	});
+	if (result.error || result.status !== 0 || result.stderr) return null;
+	return parseOpenWriters(result.stdout, root);
+}
+
+export function parseOpenWriters(output: string, directory: string): string[] {
+	const files = new Set<string>();
+	let access = "";
+	for (const line of output.split("\n")) {
+		if (line.startsWith("f")) access = "";
+		if (line.startsWith("a")) access = line.slice(1);
+		if (line.startsWith(`n${directory}/`) && (access === "w" || access === "u"))
+			files.add(relative(directory, line.slice(1)));
+	}
+	return [...files];
+}

package/index.ts

@@ -4,15 +4,15 @@
  */
 
 import { spawn } from "node:child_process";
-import { closeSync, openSync, readSync, statSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import * as path from "node:path";
+import type { Readable } from "node:stream";
 import { StringEnum } from "@earendil-works/pi-ai";
 import { type ExtensionAPI, type Theme, truncateHead, truncateTail } from "@earendil-works/pi-coding-agent";
 import { Text } from "@earendil-works/pi-tui";
 import { Type } from "typebox";
 import { callLine, countLines, fileMetadataSummary, resultLines, unstructuredResultText } from "./display.ts";
-import { RUN_HISTORY_FILE } from "./history.ts";
 import type { FileChange, RunOptions, RunResult } from "./runner.ts";
 
 // Runs typically take well under a second. Longer transformations can request more time.
@@ -34,14 +34,19 @@ export default function (pi: ExtensionAPI) {
 	// rather than throwing, since a thrown error loses them.)
 	pi.on("tool_result", async (event) => {
 		const run = event.details as RunResult | undefined;
-		if (event.toolName === "code" && run && (run.exitCode !== 0 || run.conflicts.length > 0)) return { isError: true };
+		if (
+			event.toolName === "code" &&
+			run &&
+			(run.exitCode !== 0 || run.conflicts.length > 0 || run.rolledBack.length > 0)
+		)
+			return { isError: true };
 	});
 
 	pi.registerTool({
 		name: "code",
 		label: "Code",
 		description: DESCRIPTION,
-		promptSnippet: "Make a change with one transactional Bun editing program; run verification separately afterward",
+		promptSnippet: "Make a change with one Bun editing program; run verification separately afterward",
 
 		parameters: Type.Object({
 			title: Type.String({ description: "A few words describing the change, shown to the user" }),
@@ -49,19 +54,18 @@ export default function (pi: ExtensionAPI) {
 			rollback: Type.Optional(
 				StringEnum(["all", "file"] as const, {
 					description:
-						'On failure: "all" (default) applies nothing; "file" retains files closed before a timeout when writer inspection succeeds',
+						'On failure: "file" (default) rolls back failed or interrupted file edits and retains the others; "all" applies nothing',
 				}),
 			),
 			timeout: Type.Optional(Type.Number({ description: "Seconds before the program is killed (default 2)" })),
 		}),
 
 		async execute(toolCallId, params, signal, onUpdate, ctx) {
-			// While it runs, show how long it's been going and the latest step from the log.
-			const runId = Math.random().toString(36).slice(2, 10);
+			// While it runs, show how long it's been going and the latest reported step.
 			const startedAt = Date.now();
+			let latest: string | undefined;
 			const progress = setInterval(() => {
 				const elapsed = `${((Date.now() - startedAt) / 1000).toFixed(1)} s`;
-				const latest = latestStep(runId);
 				onUpdate?.({
 					content: [{ type: "text", text: "running" }],
 					details: { progress: latest ? `${elapsed} · ${latest}` : elapsed },
@@ -70,13 +74,13 @@ export default function (pi: ExtensionAPI) {
 
 			const result = await runWithBun(
 				{
-					runId,
 					cwd: ctx.cwd,
 					program: params.program,
 					timeoutMs: (params.timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1000,
-					rollback: params.rollback ?? "all",
+					rollback: params.rollback ?? "file",
 				},
 				signal,
+				(step) => (latest = step),
 			).finally(() => clearInterval(progress));
 			return {
 				content: [{ type: "text", text: textForModel(result, toolCallId) }],
@@ -113,10 +117,17 @@ export function renderCodeResult(
  * to stop (it then puts the repository back and applies nothing). It has its own process group,
  * which is killed afterwards so no subprocess the program started is left behind.
  */
-export function runWithBun(options: RunOptions, signal?: AbortSignal): Promise<RunResult> {
+export function runWithBun(
+	options: RunOptions,
+	signal?: AbortSignal,
+	onProgress?: (step: string) => void,
+): Promise<RunResult> {
 	return new Promise((resolve, reject) => {
 		if (signal?.aborted) return reject(new Error("Aborted"));
-		const runner = spawn("bun", [path.join(import.meta.dirname, "runner.ts")], { detached: true });
+		const runner = spawn("bun", [path.join(import.meta.dirname, "runner.ts")], {
+			detached: true,
+			stdio: ["pipe", "pipe", "pipe", "pipe"],
+		});
 		const stop = () => runner.kill("SIGTERM");
 		signal?.addEventListener("abort", stop);
 
@@ -126,6 +137,22 @@ export function runWithBun(options: RunOptions, signal?: AbortSignal): Promise<R
 		runner.stderr.setEncoding("utf8");
 		runner.stdout.on("data", (chunk) => (stdout += chunk));
 		runner.stderr.on("data", (chunk) => (stderr += chunk));
+		let progressBuffer = "";
+		const progress = runner.stdio[3] as Readable;
+		progress.setEncoding("utf8");
+		progress.on("data", (chunk) => {
+			progressBuffer += chunk;
+			const lines = progressBuffer.split("\n");
+			progressBuffer = lines.pop() ?? "";
+			for (const line of lines) {
+				try {
+					const event = JSON.parse(line) as { step?: unknown };
+					if (typeof event.step === "string") onProgress?.(event.step);
+				} catch {
+					// Progress is advisory; malformed events do not affect the run.
+				}
+			}
+		});
 		runner.on("error", reject);
 		runner.on("close", (code) => {
 			signal?.removeEventListener("abort", stop);
@@ -145,33 +172,6 @@ export function runWithBun(options: RunOptions, signal?: AbortSignal): Promise<R
 	});
 }
 
-/**
- * The latest step logged for a run, e.g. "$ find / -name x" or "grep (18 ms)". Reads only the end of
- * the log, which is shared by every run.
- */
-function latestStep(runId: string): string | undefined {
-	let tail: string;
-	try {
-		const size = statSync(RUN_HISTORY_FILE).size;
-		const length = Math.min(size, 64 * 1024);
-		const buffer = Buffer.alloc(length);
-		const file = openSync(RUN_HISTORY_FILE, "r");
-		readSync(file, buffer, 0, length, size - length);
-		closeSync(file);
-		tail = buffer.toString("utf8");
-	} catch {
-		return undefined; // no log yet
-	}
-
-	const lines = tail.split("\n").filter((line) => line.includes(`"run":"${runId}"`));
-	const last = lines.at(-1);
-	if (!last) return undefined;
-	const event = JSON.parse(last);
-	if (event.event === "command") return `$ ${event.command}`;
-	if (event.event === "helper") return `${event.helper} (${event.ms} ms)`;
-	return event.event;
-}
-
 /** e.g. "✓ exit 0 · 326 ms · 6 files · +48 −17 · applied" */
 function summaryLine(run: RunResult): string {
 	const parts = [];

package/overlay-linux.ts

@@ -9,7 +9,6 @@ import * as fs from "node:fs/promises";
 import { homedir } from "node:os";
 import * as path from "node:path";
 import { $ } from "bun";
-import { historyEnabled, RUN_HISTORY_FILE, RUN_HISTORY_LOCK_DIR } from "./history.ts";
 import type { FilesystemEntry, Overlay } from "./runner.ts";
 
 export async function openLinuxOverlay(repo: string, tempDir: string): Promise<Overlay> {
@@ -24,8 +23,6 @@ export async function openLinuxOverlay(repo: string, tempDir: string): Promise<O
 	const cacheDir = path.join(homedir(), ".cache", "pi-shorthand");
 	const internalDir = path.join(cacheDir, "sandbox");
 	const sandboxExcludesFile = path.join(internalDir, `${path.basename(tempDir)}.exclude`);
-	const logFile = RUN_HISTORY_FILE;
-	const keepHistory = historyEnabled();
 	await copyStableTree(repo, lower);
 	const filesAtStart = await gitVisibleFiles(lower);
 	await fs.mkdir(upper);
@@ -41,8 +38,6 @@ export async function openLinuxOverlay(repo: string, tempDir: string): Promise<O
 	}
 	if ((internalStats.mode & 0o077) !== 0) await fs.chmod(internalDir, 0o700);
 	await fs.writeFile(sandboxExcludesFile, "", { flag: "wx", mode: 0o600 });
-	if (keepHistory) await fs.appendFile(logFile, "", { mode: 0o600 });
-	if (keepHistory) await fs.mkdir(RUN_HISTORY_LOCK_DIR, { recursive: true, mode: 0o700 });
 
 	const wrap = (command: string[], cwd: string) => [
 		bwrap,
@@ -61,8 +56,6 @@ export async function openLinuxOverlay(repo: string, tempDir: string): Promise<O
 		upper,
 		work,
 		repo,
-		...(keepHistory ? ["--bind", logFile, logFile] : []),
-		...(keepHistory ? ["--bind", RUN_HISTORY_LOCK_DIR, RUN_HISTORY_LOCK_DIR] : []),
 		"--tmpfs",
 		"/dev/shm",
 		"--chdir",

package/overlay-macos.ts

@@ -31,7 +31,9 @@ export async function openMacOverlay(repo: string, tempDir: string): Promise<Ove
 	const base = path.join(tempDir, "base");
 	const mountContainer = await fs.mkdtemp(path.join(await fs.realpath(tmpdir()), "pi-shorthand-workspace-"));
 	const mount = path.join(mountContainer, "repo");
+	const scratch = path.join(mountContainer, "tmp");
 	await fs.mkdir(mount);
+	await fs.mkdir(scratch);
 	const state: RecoveryState = { runnerPid: process.pid, tempDir, mountContainer, mount };
 	await writeRecoveryState(stateFile, state);
 
@@ -48,11 +50,12 @@ export async function openMacOverlay(repo: string, tempDir: string): Promise<Ove
 			originalDir: base,
 			writableDir: mount,
 			executionDir: mount,
+			environment: { TMPDIR: scratch, TMP: scratch, TEMP: scratch },
 			gitExcludes: ["._*"],
 			wrap: (command) => [
 				"/usr/bin/sandbox-exec",
 				"-p",
-				sandboxProfile(repo, tempDir, mount, stateFile, gitMetadata, processDeniedCanary, cleanupHelper),
+				sandboxProfile(repo, tempDir, mount, stateFile, gitMetadata, processDeniedCanary, cleanupHelper, scratch),
 				...command,
 			],
 			terminateProcesses: async () => {
@@ -199,7 +202,9 @@ async function serveAndMount(
 	try {
 		await onSpawn(server.pid);
 		await waitForPort(port);
-		const options = `locallocks,vers=3,tcp,port=${port},mountport=${port},soft,timeo=100,retrans=5`;
+		// AgentFS copy-up can change directory attributes. Stale NFS directory caches can make
+		// getcwd() fail in nested directories; keep file caching but revalidate directories immediately.
+		const options = `locallocks,vers=3,tcp,port=${port},mountport=${port},soft,timeo=100,retrans=5,acdirmin=0,acdirmax=0`;
 		await $`/sbin/mount_nfs -o ${options} 127.0.0.1:/ ${mount}`.quiet();
 		return server;
 	} catch (error) {
@@ -209,8 +214,8 @@ async function serveAndMount(
 	}
 }
 
-/** The program may write only to its private mount, excluding the real checkout and Git metadata. */
-function sandboxProfile(
+/** Restrict writes to the workspace, private scratch space and devices. */
+export function sandboxProfile(
 	repo: string,
 	tempDir: string,
 	mount: string,
@@ -218,10 +223,15 @@ function sandboxProfile(
 	gitMetadata: string[],
 	processDeniedCanary: string,
 	cleanupHelper: string,
+	scratch: string,
 ): string {
 	return [
 		"(version 1)",
 		"(allow default)",
+		"(deny file-write*)",
+		`(allow file-write* (require-all (subpath ${JSON.stringify(mount)}) (require-not (subpath ${JSON.stringify(path.join(mount, ".git"))}))))`,
+		`(allow file-write* (subpath ${JSON.stringify(scratch)}))`,
+		'(allow file-write-data (literal "/dev/null") (literal "/dev/tty"))',
 		`(deny file-read* (subpath ${JSON.stringify(repo)}))`,
 		`(deny file-write* (subpath ${JSON.stringify(repo)}))`,
 		`(deny file-write* (subpath ${JSON.stringify(tempDir)}))`,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-shorthand",
-	"version": "0.3.0",
+	"version": "0.3.2",
 	"description": "Pi tool for editing repositories with Bun programs, text edits and structural transformations.",
 	"keywords": [
 		"ast-grep",
@@ -33,7 +33,7 @@
 		"lint": "oxlint --deny-warnings",
 		"format": "oxfmt",
 		"check": "tsc -p . && oxlint --deny-warnings && oxfmt --check",
-		"postinstall": "grit init --global",
+		"setup:grit": "grit init --global",
 		"prepare": "git config core.hooksPath .githooks 2>/dev/null || true"
 	},
 	"dependencies": {

package/placement.ts

@@ -2,6 +2,7 @@
 import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { Lang, parse, type SgNode } from "@ast-grep/napi";
+import { editingFiles } from "./file-outcomes.ts";
 
 export interface Match {
 	file: string;
@@ -291,11 +292,23 @@ function apply(plans: { saved: Snapshot; edits: Edit[] }[]) {
 }
 
 export function insert(text: string, destination: Destination): void {
+	return editingFiles(destinationFiles(destination), () => insertNodes(text, destination));
+}
+
+function destinationFiles(destination: Destination): string[] {
+	return Object.values(destination).flatMap((match) => (typeof match?.file === "string" ? [match.file] : []));
+}
+
+function insertNodes(text: string, destination: Destination): void {
 	const { saved, edit } = placement(text, destination);
 	apply([{ saved, edits: [edit] }]);
 }
 
 export function move(match: Match, destination: Destination, transform?: (text: string) => string): void {
+	return editingFiles([match.file, ...destinationFiles(destination)], () => moveNodes(match, destination, transform));
+}
+
+function moveNodes(match: Match, destination: Destination, transform?: (text: string) => string): void {
 	const source = snapshot(match);
 	const deletion = removal(source);
 	const text = transform ? transform(source.node.text()) : source.node.text();
@@ -322,6 +335,14 @@ export function move(match: Match, destination: Destination, transform?: (text:
 }
 
 export function remove(matches: Match | readonly Match[]): void {
+	const selected = Array.isArray(matches) ? matches : [matches as Match];
+	return editingFiles(
+		selected.map((match) => match.file),
+		() => removeNodes(matches),
+	);
+}
+
+function removeNodes(matches: Match | readonly Match[]): void {
 	const plans = new Map<string, { saved: Snapshot; edits: Edit[] }>();
 	for (const match of Array.isArray(matches) ? matches : [matches as Match]) {
 		const saved = snapshot(match);