Michael Ramos 4c89418bad fix(pi): contain the pi-todos mirror inside the project root ...

The mirror resolved <cwd>/.pi/todos with a plain path.join, so a repo
that ships .pi/todos as a symlink pointing elsewhere had its plan
checklist written to the symlink target on the first plan approval. The
mirror is on by default, so checking out a hostile repo and approving a
plan was enough. Write-only and non-overwriting, but not something to
ship knowingly.

The repo-implied path must now realpath inside cwd or the provider reads
as absent, which is the documented no-mirror no-op. An explicit
PI_TODO_PATH stays trusted verbatim: that is the user's own choice at the
same trust level as config.json, and pi-todos honors it the same way.
Containment reuses the shared isWithinDirectory sink, resolved through
the deepest existing ancestor so a not-yet-created todos dir under a
symlinked .pi cannot be created outside either.

Also corrects the detection docstring: pi-todos calls ensureTodosDir on
session_start, so an installed-but-unused provider does not read as
absent.

Claude-Session: https://claude.ai/code/session_01H5KQWqXqjrPxyxUNso1QHS

2026-07-30 03:03:13 -07:00

..

index.ts

feat(pi): mirror plan checklist to pi-todos (#1139)

2026-07-27 10:27:03 -07:00

pi-todos.test.ts

fix(pi): contain the pi-todos mirror inside the project root

2026-07-30 03:03:13 -07:00

pi-todos.ts

fix(pi): contain the pi-todos mirror inside the project root

2026-07-30 03:03:13 -07:00

types.ts

feat(pi): mirror plan checklist to pi-todos (#1139)

2026-07-27 10:27:03 -07:00