fix: resolve Pi npm installs for account imports by BytePioneer-AI · Pull Request #592 · BytePioneer-AI/codex-host

BytePioneer-AI · 2026-10-24T05:11:12Z

Summary

Resolve Pi's npm package directory from the executable selected by the Pi Harness, including Windows NVM shims.
Invoke Pi's declared JavaScript CLI entry for the offline provider-collision check instead of passing a Windows .cmd shim to Node.
Add regression coverage for shim discovery and safe CLI entry resolution.

Validation

RUN v4.1.10 D:/work/code/codex-host

Test Files 2 passed (2)
Tests 19 passed (19)
Start at 13:10:57
Duration 817ms (transform 231ms, setup 0ms, import 731ms, tests 189ms, environment 0ms) (19 passed)

codexhost@0.13.3 typecheck
tsc -b --pretty false && tsc -p tests/tsconfig.json --noEmit --pretty false

chatgpt-codex-connector · 2026-10-24T05:11:25Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T05:13:54.899919Z	`8690b97`	PR opened
🔒 Security Review	🔄 Running since 2026-10-24T05:11:22.612549Z	`8690b97`	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

coderabbitai · 2026-10-24T05:11:46Z

No actionable comments were generated in the recent review.

Recent review info

Run configuration

Source mode: Auto
Repository: BytePioneer-AI/codex-host
Branch: fix/pi-account-import-discovery
File: .coderabbit.yaml
Commit: 8690b97
Layers: Repository YAML
Review profile: CHILL
Plan: Advanced
Run ID: 20639000-8e34-4a0d-b513-32a0758810dd

Commits

Reviewing files that changed from the base of the PR and between ab2fbaf and 8690b97.

Files selected for processing: 3

packages/adapters/pi/src/command.ts
packages/adapters/pi/src/pi-credential-imports.ts
packages/adapters/pi/test/command.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 7 remain after this review.

Recent review details

Context from checks skipped due to timeout: 4

GitHub Check: Check windows-latest
GitHub Check: Check ubuntu-22.04
GitHub Check: Check macos-14
GitHub Check: Check Linux ARM64

Additional context used

Code guidelines: 1

AGENTS.md — auto-discovered

Path-based instructions: 1

Source excerpt: `codexhost` runs external Agent Harnesses as independent Threads inside Codex Desktop, preserving the official shell and native Codex path.

CodeRabbit inference engine (AGENTS.md)

Files:

packages/adapters/pi/src/pi-credential-imports.ts
packages/adapters/pi/src/command.ts
packages/adapters/pi/test/command.test.ts

ast-grep (0.45.3)

packages/adapters/pi/src/command.ts

[warning] 65-65: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(candidate, "package.json"), "utf8")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename-typescript)

[warning] 89-89: Filesystem path is not a string literal; a request-/variable-derived path can enable path traversal. Validate and normalize the path before use.
Context: fs.readFileSync(path.join(packageDirectory, "package.json"), "utf8")
Note: [CWE-22] Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal').

(detect-non-literal-fs-filename-typescript)

Additional comments: 3

packages/adapters/pi/src/command.ts: 1

13-14: LGTM!

Also applies to: 59-59, 86-86

packages/adapters/pi/test/command.test.ts: 1

1-85: LGTM!

packages/adapters/pi/src/pi-credential-imports.ts: 1

29-29: LGTM!

Also applies to: 121-123, 153-153

📝 Summary

Summary by CodeRabbit

修复
- 改进 Pi 安装识别与命令入口验证，减少将不受支持或无关的安装误判为可用安装。
- 获取离线模型列表时改为通过 Pi CLI 入口执行。

Pi 适配器新增 Pi npm 包目录和 CLI 入口发现功能。安装定位现在要求同时找到受支持的包和 CLI 入口。离线模型列表命令改为通过发现的 CLI 入口执行。

Changes: Pi CLI 发现与调用

层 / 文件	摘要
包目录与 CLI 入口发现 `packages/adapters/pi/src/command.ts`, `packages/adapters/pi/test/command.test.ts`	新增从可执行文件目录向上查找 Pi 包的函数，以及读取并校验包内 CLI 入口的函数。测试覆盖包目录发现、入口查找、越界入口拒绝和无关包名排除。
安装定位与 CLI 调用 `packages/adapters/pi/src/pi-credential-imports.ts`	安装定位使用新函数查找 Pi 包和 CLI 入口；未找到任一项时仍抛出原有的不支持安装错误。离线模型列表命令改为执行发现的 CLI 入口。

Priority: Normal

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

Sequence Diagram(s)

sequenceDiagram
  participant Installation as 安装定位
  participant PackageFinder as findPiPackageDirectory
  participant EntryFinder as findPiCliEntry
  participant ProviderNames as configuredProviderNames
  participant PiCLI as Pi CLI
  Installation->>PackageFinder: 根据可执行文件查找 Pi 包目录
  PackageFinder-->>Installation: 返回包目录
  Installation->>EntryFinder: 根据包目录查找 CLI 入口
  EntryFinder-->>Installation: 返回 CLI 入口
  ProviderNames->>PiCLI: 执行离线模型列表命令

Possibly related PRs

BytePioneer-AI/codex-host#575：修改相同的 Pi 安装与 Provider 冲突检查路径；本 PR 改为使用发现的 Pi CLI 入口执行离线 Provider 列表命令。

Suggested labels: 范围:适配器

Merge Risk: Minimal · up to 8690b

The Pi install-discovery change is mergeable after normal checks; no actionable risk remains identified.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		标题“fix: resolve Pi npm installs for account imports”与变更集主要内容相符。变更新增了 Pi 包目录查找（含 Windows NVM shim 场景）和 CLI 入口解析，并将离线模型列表命令改为通过 CLI 入口执行，目的是修复账户导入时的 Pi npm 安装识别问题。标题简短且具体，可表达主要变更。
Description check		描述列出了三项变更要点：从所选可执行文件解析 Pi npm 包目录（含 Windows NVM shim）、使用 Pi 声明的 JavaScript CLI 入口替代 .cmd shim、新增回归测试。这些内容与 command.ts、pi-credential-imports.ts 和 command.test.ts 的变更直接对应。描述还包含测试与类型检查输出。
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Finishing Touches

📝 Generate docstrings

Commit to this branch
Create a new PR

🧪 Generate unit tests (beta)

Commit to this branch
Create a new PR

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8690b97557

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-24T05:13:52Z

+export function findPiPackageDirectory(executable: string): string | undefined {
+  let directory = path.dirname(executable);
+  while (true) {
+    for (const candidate of [directory, path.join(directory, PI_PACKAGE_PATH)]) {


Verify that the discovered package backs the executable

When the selected executable is a wrapper or non-npm Pi binary beneath any directory containing a separate node_modules/@earendil-works/pi-coding-agent—for example, a custom wrapper inside a project with a stale Pi dependency—this loop accepts that unrelated package from any ancestor without establishing that the executable points to it. installation() then imports authentication modules, performs collision checks, and generates extension paths using a different Pi installation, contradicting its guarantee to reject unrelated installs; restrict the fallback to a verified npm shim layout or validate the shim's target.

Useful? React with 👍 / 👎.

fix: resolve Pi npm installs for account imports

8690b97

chatgpt-codex-connector Bot reviewed Oct 24, 2026

View reviewed changes

BytePioneer-AI merged commit f537b71 into main Oct 24, 2026
5 checks passed

Navigation Menu

Repository navigation

fix: resolve Pi npm installs for account imports - #592

fix: resolve Pi npm installs for account imports#592
BytePioneer-AI merged 1 commit into
mainfrom
fix/pi-account-import-discovery

BytePioneer-AI commented Oct 24, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading

Summary by CodeRabbit

Sequence Diagram(s)

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

BytePioneer-AI commented Oct 24, 2026

Summary

Validation

Test Files 2 passed (2) Tests 19 passed (19) Start at 13:10:57 Duration 817ms (transform 231ms, setup 0ms, import 731ms, tests 189ms, environment 0ms) (19 passed)

Uh oh!

chatgpt-codex-connector Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

coderabbitai Bot commented Oct 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Sequence Diagram(s)

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Test Files 2 passed (2)
Tests 19 passed (19)
Start at 13:10:57
Duration 817ms (transform 231ms, setup 0ms, import 731ms, tests 189ms, environment 0ms) (19 passed)

chatgpt-codex-connector Bot commented Oct 24, 2026 •

edited

Loading

coderabbitai Bot commented Oct 24, 2026 •

edited

Loading