pi-shorthand 0.5.0 → 0.6.0

package/README.md

@@ -20,9 +20,10 @@ xcode-select --install
 curl -fsSL https://agentfs.ai/install | bash
 ```
 
-On Linux, install bubblewrap 0.9 or later, a C compiler, and `lsof`. For Debian and Ubuntu:
+On Linux, install bubblewrap 0.11 or later, a C compiler, and `lsof`. For Debian and Ubuntu, check the available bubblewrap version before installing:
 
 ```sh
+apt-cache policy bubblewrap
 sudo apt install bubblewrap build-essential lsof
 ```
 
@@ -31,3 +32,5 @@ sudo apt install bubblewrap build-essential lsof
 pi-shorthand gives Pi a programming environment instead of a patch format. This makes multi-file and structural edits possible in one call, but does not guarantee that Pi will find it easier or more reliable than its built-in edit tool. Which works better depends on the model and the task.
 
 Programs edit a private workspace, with host files outside the repository kept read-only. By default, a failure keeps completed files and rolls back failed or interrupted edits. Concurrent edits can cause a run to be rejected; conflict detection is best-effort, not an atomic commit.
+
+The `code` tool uses Pi's working directory by default. Pass `cwd` to target another checkout; relative paths are resolved from Pi's working directory. For example, when Pi starts in a bare worktree container, `cwd: "child"` targets its `child` worktree. The chosen directory must be inside a Git worktree.

package/display.ts

@@ -21,8 +21,15 @@ const INLINE_DIFF_LINES = 40; // a longer diff collapses to a list of its files
 const LISTED_FILES = 8; // …showing this many, then "and N more files"
 const EXPANDED_DIFF_LINES = 2000; // even expanded, a diff of hundreds of files stops here
 
-export function callLine(args: { title?: string; timeout?: number; rollback?: string }, theme: Theme): string {
-	const settings = [args.rollback === "all" && "rollback all", args.timeout && `program timeout ${args.timeout}s`];
+export function callLine(
+	args: { title?: string; cwd?: string; timeout?: number; rollback?: string },
+	theme: Theme,
+): string {
+	const settings = [
+		args.cwd && `cwd ${args.cwd}`,
+		args.rollback === "all" && "rollback all",
+		args.timeout && `program timeout ${args.timeout}s`,
+	];
 	const suffix = settings.filter(Boolean).join(", ");
 	return `${theme.fg("toolTitle", theme.bold("code"))} ${args.title ?? ""}${suffix ? theme.fg("muted", ` (${suffix})`) : ""}`;
 }

package/index.ts

@@ -35,7 +35,7 @@ class RunnerError extends Error {
 // Runs typically take well under a second. Longer transformations can request more time.
 const DEFAULT_TIMEOUT_SECONDS = 2;
 
-const DESCRIPTION = `Edit repository files with a TypeScript program run by Bun. Top-level await and ordinary Bun/Node APIs work. Use repository-relative paths. The program runs in an isolated workspace; changes apply on successful exit by default and the tool reports the diff. Run tests, type-checks and builds separately afterward with the shell tool.
+const DESCRIPTION = `Edit repository files with a TypeScript program run by Bun. Top-level await and ordinary Bun/Node APIs work. Use repository-relative paths. Set cwd to a checkout path when Pi's working directory is outside the repository, such as a child worktree in a bare worktree container. The program runs in an isolated workspace; changes apply on successful exit by default and the tool reports the diff. Run tests, type-checks and builds separately afterward with the shell tool.
 
 Common operations:
 - edit({ path, oldText, newText }) replaces exactly one literal occurrence; missing or ambiguous text is an error. Use text edits for known source, structural matching when it saves enumerating occurrences or preserves varying syntax.
@@ -70,6 +70,12 @@ export default function (pi: ExtensionAPI) {
 		parameters: Type.Object({
 			title: Type.String({ description: "A few words describing the change, shown to the user" }),
 			program: Type.String({ description: "TypeScript program run with Bun (top-level await allowed)" }),
+			cwd: Type.Optional(
+				Type.String({
+					description:
+						"Working directory for the program; relative to Pi's working directory, or an absolute path. Defaults to Pi's working directory. Must be inside a git worktree.",
+				}),
+			),
 			rollback: Type.Optional(
 				StringEnum(["all", "file"] as const, {
 					description:
@@ -95,7 +101,7 @@ export default function (pi: ExtensionAPI) {
 			try {
 				result = await runWithBun(
 					{
-						cwd: ctx.cwd,
+						cwd: path.resolve(ctx.cwd, params.cwd ?? "."),
 						program: params.program,
 						timeoutMs: (params.timeout ?? DEFAULT_TIMEOUT_SECONDS) * 1000,
 						rollback: params.rollback ?? "file",

package/linux-observer.c

@@ -37,6 +37,7 @@ static const char *repository;
 static size_t repository_length;
 static pid_t initial;
 static volatile sig_atomic_t stopping;
+static int unresolved_external_permission;
 
 enum observation_kind {
     OBSERVE_CONTENTS = 'C',
@@ -121,6 +122,61 @@ static void descriptor(pid_t pid, int fd, char result[PATH_MAX]) {
     result[length] = 0;
     if (within(result) && strstr(result, " (deleted)")) die("unresolved deleted repository descriptor");
 }
+/* A missing getprocattr hook reports EINVAL. Other errors, including a label
+ * larger than our buffer, leave the access context unknown. */
+static int security_label(const char *path, char label[4096], size_t *length) {
+    int fd = open(path, O_RDONLY|O_CLOEXEC);
+    if (fd < 0) return -1;
+    size_t used = 0;
+    for (;;) {
+        char extra;
+        char *destination = used < 4096 ? label + used : &extra;
+        size_t available = used < 4096 ? 4096 - used : 1;
+        ssize_t count = read(fd, destination, available);
+        if (count < 0 && errno == EINTR) continue;
+        if (count < 0) {
+            int error = errno;
+            close(fd);
+            return used == 0 && error == EINVAL ? 0 : -1;
+        }
+        if (!count) { close(fd); *length = used; return 1; }
+        if (used == 4096) { close(fd); return -1; }
+        used += count;
+    }
+}
+static int same_access_context(pid_t pid) {
+    char tracee_path[96], tracee[4096], self[4096];
+    snprintf(tracee_path, sizeof(tracee_path), "/proc/%d/status", pid);
+    FILE *a = fopen(tracee_path, "r"), *b = fopen("/proc/self/status", "r");
+    if (!a || !b) { if (a) fclose(a); if (b) fclose(b); return 0; }
+    const char *fields[] = { "Uid:", "Gid:", "Groups:", "CapEff:" };
+    unsigned matched = 0;
+    while (fgets(tracee, sizeof(tracee), a)) {
+        for (size_t j = 0; j < sizeof(fields)/sizeof(*fields); j++) {
+            if (strncmp(tracee, fields[j], strlen(fields[j]))) continue;
+            if (!strchr(tracee, '\n')) { fclose(a); fclose(b); return 0; }
+            rewind(b);
+            int found = 0;
+            while (fgets(self, sizeof(self), b)) {
+                if (!strncmp(self, fields[j], strlen(fields[j]))) {
+                    if (!strchr(self, '\n') || strcmp(tracee, self)) { fclose(a); fclose(b); return 0; }
+                    found = 1;
+                    break;
+                }
+            }
+            matched += found;
+        }
+    }
+    fclose(a); fclose(b);
+    if (matched != sizeof(fields)/sizeof(*fields)) return 0;
+    snprintf(tracee_path, sizeof(tracee_path), "/proc/%d/attr/current", pid);
+    size_t tracee_length = 0, self_length = 0;
+    int tracee_label = security_label(tracee_path, tracee, &tracee_length);
+    int self_label = security_label("/proc/self/attr/current", self, &self_length);
+    return (tracee_label == 0 && self_label == 0) ||
+        (tracee_label == 1 && self_label == 1 && tracee_length == self_length &&
+         !memcmp(tracee, self, tracee_length));
+}
 /* Walk symlinks in the tracee's mount view, recording each repository link.
  * Never use realpath(/proc/PID/root/...): that can resolve against the host mount.
  */
@@ -182,7 +238,17 @@ static void resolve_name(pid_t pid, int fd, const char *input, int follow, char
         snprintf(visible, sizeof(visible), "/proc/%d/root%s", pid, result);
         struct stat info;
         int exists = lstat(visible, &info);
-        if (exists < 0 && errno != ENOENT && errno != ENOTDIR) die("cannot inspect tracee path");
+        if (exists < 0 && errno != ENOENT && errno != ENOTDIR) {
+            if ((errno == EACCES || errno == EPERM) && !within(result) && same_access_context(pid)) {
+                /* Matching filesystem credentials, capabilities and security
+                 * label make this external denial apply to the tracee too.
+                 * Confirm the syscall is denied before resuming it. */
+                unresolved_external_permission = 1;
+                result[0] = 0;
+                return;
+            }
+            die("cannot inspect tracee path");
+        }
         if ((!*rest && !follow) || exists < 0 || !S_ISLNK(info.st_mode)) {
             snprintf(pending, sizeof(pending), "%s", rest);
             continue;
@@ -353,6 +419,7 @@ struct task {
     int initial_stop;
     int registered;
     int waiting;
+    int checking_permission;
     struct task *next;
 };
 static struct task *tasks;
@@ -372,7 +439,8 @@ static struct task *task(pid_t pid) {
  * is not completion: retain the live record until wait reports its death or
  * an exec event explicitly identifies the replaced thread ID. */
 static void resume_task(pid_t pid, int signal) {
-    if (ptrace(PTRACE_CONT, pid, 0, signal) && errno != ESRCH) die("trace resume failed");
+    int request = task(pid)->checking_permission ? PTRACE_SYSCALL : PTRACE_CONT;
+    if (ptrace(request, pid, 0, signal) && errno != ESRCH) die("trace resume failed");
 }
 static void syscall_entry(pid_t pid, struct ptrace_syscall_info *info) {
     __u64 *a = info->seccomp.args; long nr = info->seccomp.nr;
@@ -514,6 +582,8 @@ static void exec_event(pid_t pid) {
     unsigned long former;
     if (ptrace(PTRACE_GETEVENTMSG, pid, 0, &former)) die("missing exec thread identity");
     struct task *current = task(pid);
+    if (current->checking_permission || (former != (unsigned long)pid && task(former)->checking_permission))
+        die("unresolved external path was executed");
     if (former != (unsigned long)pid) {
         current->bootstrap = task(former)->bootstrap;
         task(former)->alive = 0;
@@ -559,7 +629,7 @@ int main(int argc, char **argv) {
     int status, exit_code = 125;
     if (waitpid(initial, &status, 0) != initial || !WIFSTOPPED(status)) die("initial trace stop");
     long flags = PTRACE_O_TRACEFORK|PTRACE_O_TRACEVFORK|PTRACE_O_TRACECLONE|PTRACE_O_TRACEEXEC|
-        PTRACE_O_TRACESECCOMP|PTRACE_O_EXITKILL;
+        PTRACE_O_TRACESECCOMP|PTRACE_O_TRACESYSGOOD|PTRACE_O_EXITKILL;
     if (ptrace(PTRACE_SETOPTIONS, initial, 0, flags)) die("ptrace options");
     task(initial)->bootstrap = BEFORE_BWRAP_EXEC;
     task(initial)->registered = 1;
@@ -593,7 +663,22 @@ int main(int argc, char **argv) {
             struct ptrace_syscall_info info;
             if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, sizeof(info), &info) < 0 || info.op != PTRACE_SYSCALL_INFO_SECCOMP)
                 die("syscall information unavailable");
-            syscall_entry(pid, &info); signal = 0;
+            unresolved_external_permission = 0;
+            syscall_entry(pid, &info);
+            if (unresolved_external_permission) task(pid)->checking_permission = 1;
+            signal = 0;
+        } else if (signal == (SIGTRAP|0x80) && task(pid)->checking_permission) {
+            struct ptrace_syscall_info info;
+            if (ptrace(PTRACE_GET_SYSCALL_INFO, pid, sizeof(info), &info) < 0)
+                die("unresolved external path result unavailable");
+            if (info.op == PTRACE_SYSCALL_INFO_EXIT) {
+                if (info.exit.rval != -EACCES && info.exit.rval != -EPERM)
+                    die("unresolved external path was accessed");
+                task(pid)->checking_permission = 0;
+            } else if (info.op != PTRACE_SYSCALL_INFO_ENTRY) {
+                die("unresolved external path result unavailable");
+            }
+            signal = 0;
         } else if (event == PTRACE_EVENT_FORK || event == PTRACE_EVENT_VFORK || event == PTRACE_EVENT_CLONE) {
             descendant_event(pid);
             signal = 0;

package/overlay-linux.ts

@@ -1,5 +1,5 @@
 /**
- * Linux: bubblewrap (0.9+) mounts a kernel overlayfs over the repository in a private mount
+ * Linux: bubblewrap (0.11+) mounts a kernel overlayfs over the repository in a private mount
  * namespace, so only the program sees it. Its writes land in an upper directory in tempDir, which
  * is also where the changes are read from. There's nothing to undo afterwards.
  */
@@ -14,7 +14,7 @@ import type { TransactionJournal } from "./transaction-journal.ts";
 
 export async function openLinuxOverlay(repo: string, tempDir: string): Promise<Overlay> {
 	const bwrap = Bun.which("bwrap");
-	if (!bwrap) throw new Error("The code tool needs bubblewrap (0.9 or later) on Linux.");
+	if (!bwrap) throw new Error("The code tool needs bubblewrap (0.11 or later) on Linux.");
 
 	// Best-effort live lower: validation does not remove OverlayFS's documented
 	// restriction on concurrent external modifications of an underlying layer.

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "pi-shorthand",
-	"version": "0.5.0",
+	"version": "0.6.0",
 	"description": "Pi tool for editing repositories with Bun programs, text edits and structural transformations.",
 	"keywords": [
 		"ast-grep",