Visit files and run shell commands from chat (#250)

* Add strict chat file target resolver

* Harden chat file target resolution

* Resolve Markdown link file targets

* Run shell command on chat file target

* Harden chat shell command execution

* Visit chat file targets with RET

* Harden chat RET file navigation

* Keep button-remap test keybindings off the shared chat mode map

local-set-key mutates the shared mode map when the buffer's local map
is the mode map, and (kbd "C-c RET") is C-c C-m.  Give the test
buffer its own keymap copy so C-c C-m keeps its select-model binding
for later tests.

Author: dnouri

README.org

@@ -176,11 +176,29 @@ Markdown pipe tables get a display-only treatment: wide tables are
 wrapped and drawn to neatly fit window width, with cleaner separators,
 while the underlying buffer text remains ordinary Markdown.
 
-Output from file tools such as =read=, =write=, and =edit=, and custom
-tools that include =:path= allow that =RET= on a file-content line
-opens the backing file at the matching line.  By default the file
-opens in the other window so the chat stays visible; use =C-u RET= to
-open it in the same window instead.
+Press =RET= on one strict file target at point: a file-content row in tool
+output, a plain path reference, or the label of a local Markdown link.
+Tool headers, fences, preview hints, and other non-content rows do not open
+files.  Plain locations such as =src/app.el:12:3= visit their one-based
+physical file line and optional one-based column; a range such as
+=src/app.el#L12-L20= visits its first line only.  If an explicit location is
+outside an existing narrowing, the default =widen-automatically= policy widens
+the file.  Coordinates apply only to file-visiting buffers; directory targets
+retain native Dired point and marks.  A target without a location keeps the
+point, mark, and narrowing chosen by normal Emacs file visiting.
+
+By default Pi requests the native other-window opener.  Use =C-u RET= to invert
+=pi-coding-agent-visit-file-other-window= for that visit; with the default
+setting this requests the same-window opener instead.  Emacs display policy may
+redirect the final placement.
+
+Press =!= on one strict file target at point for a Dired-inspired shell
+command.  One command word followed only by whitespace-delimited options
+beginning with =-= safely receives the quoted target automatically.  All other
+command text, including ordinary arguments, compound/control syntax, and
+multiple lines, must use a textual isolated =*= bounded by a space, tab, or
+string edge.  A final whitespace-delimited = &= uses the usual asynchronous
+shell output.
 
 Press =TAB= on a turn header (=You= or =Assistant=) to fold or unfold
 that turn.  Use =n= and =p= in the chat buffer to jump between user
@@ -219,7 +237,8 @@ and error thresholds.
 | =TAB=            | input   | 🪄 Complete paths, and =/= commands           |
 | =M+<prior/next>= | input   | 🛗 Scroll linked chat window                  |
 | =TAB=            | chat    | 🪗 Toggle thinking block, tool block, or turn |
-| =RET=            | chat    | 🎯 Visit file at point from tool output       |
+| =!=              | chat    | 🐚 Run a Dired-inspired command on a file    |
+| =RET=            | chat    | 🎯 Visit strict file target at point          |
 | =n= / =p=        | chat    | 🐾 Navigate user messages                     |
 | =f=              | chat    | 🌿 Fork from the turn at point                |
 | =q=              | chat    | 👋 Quit session                               |
@@ -422,7 +441,9 @@ Here's some common non-default preferences:
 ;; Copy source Markdown from the chat buffer instead of only visible text:
 (setopt pi-coding-agent-copy-raw-markdown t)
 
-;; Open files from tool output in the current window instead of another window:
+;; Request the native same-window opener for chat file targets;
+;; use C-u RET to invert this request for one visit.  Emacs display policy
+;; may redirect final placement:
 (setopt pi-coding-agent-visit-file-other-window nil)
 #+end_src
 

pi-coding-agent-core.el

@@ -163,6 +163,16 @@ connection."
   (and (pi-coding-agent--remote-home-path-p path)
        (not (pi-coding-agent--plain-remote-home-path-p path))))
 
+(defun pi-coding-agent--safe-shell-remote-home-path-p (path)
+  "Return non-nil when PATH has a portable remote-shell home prefix.
+Accept plain `~' and POSIX portable named-user forms such as `~root/path'.
+Reject shell-significant and reserved expansion forms before an unquoted tilde
+prefix can cross the shell-host path boundary."
+  (and (stringp path)
+       (string-match-p
+        "\\`\\(?:~\\|~[[:alpha:]_][[:alnum:]_.-]*\\)\\(?:/\\|\\'\\)"
+        path)))
+
 (defun pi-coding-agent--remote-prefix-for-path (path)
   "Return PATH's full TRAMP remote prefix, or nil."
   (and (stringp path)
@@ -282,6 +292,85 @@ process filters or callbacks."
       (substring path (length prefix))
     (file-local-name path)))
 
+(defun pi-coding-agent--shell-command-path (path &optional anchor)
+  "Return unquoted PATH in the shell host's file-name namespace.
+The shell host is selected by ANCHOR or `default-directory': local paths stay
+local, while paths under a remote ANCHOR are for the remote shell started by
+Emacs's `shell-command' file-name handler.  Relative paths become absolute,
+matching TRAMP prefixes (including multi-hop routes) are removed, and remote
+`~/' and `~USER/' forms remain unexpanded for that shell.  Local home paths are
+expanded by Emacs.  Exactly one recognized Emacs file-name quote layer is
+removed.  Explicit remote local names must then be absolute or home-rooted;
+empty and relative forms are rejected rather than reinterpreted lexically.
+
+This is deliberately separate from `pi-coding-agent--process-local-path', whose
+outbound JSON contract is specific to Pi RPC and rejects named remote homes.
+This pure conversion neither checks file existence nor contacts a remote host.
+Malformed or incompatible remote paths signal `user-error'."
+  (when-let* ((emacs-path (pi-coding-agent--emacs-path path anchor)))
+    (let* ((remote-anchor (pi-coding-agent--remote-prefix anchor))
+           (localname (file-name-unquote
+                       (pi-coding-agent--local-name-for-process emacs-path))))
+      (cond
+       ((not remote-anchor)
+        (if (file-name-absolute-p localname)
+            localname
+          (let ((file-name-handler-alist nil))
+            (expand-file-name
+             localname
+             (file-name-unquote (or anchor default-directory))))))
+       ((string-prefix-p "/" localname)
+        localname)
+       ((pi-coding-agent--safe-shell-remote-home-path-p localname)
+        localname)
+       ((pi-coding-agent--remote-home-path-p localname)
+        (user-error "Unsafe shell home prefix in path: %S" localname))
+       (t
+        (user-error "Remote shell path is not absolute or home-rooted: %S"
+                    localname))))))
+
+(defun pi-coding-agent--shell-quote-path (path &optional anchor)
+  "Quote shell-local PATH exactly once for a shell under ANCHOR.
+PATH should be the result of `pi-coding-agent--shell-command-path'.  A remote
+`~/' or portable `~USER/' prefix is left unquoted so the remote shell can
+expand it; only the remaining path is POSIX-quoted.  Other remote paths use
+POSIX quoting in full, while local paths use the platform's normal
+`shell-quote-argument' behavior.  A terminal ampersand gets an adjacent empty
+quoted fragment because `shell-command' otherwise treats it as an async marker
+without parsing the shell escape.  Unsafe home prefixes and malformed paths
+signal `user-error'."
+  (pi-coding-agent--ensure-usable-path-string path)
+  (unless (and (stringp path) (not (string-empty-p path)))
+    (user-error "Shell path is empty or not a string"))
+  (let* ((remote-anchor (pi-coding-agent--remote-prefix anchor))
+         (quoted
+          (if (and remote-anchor
+                   (pi-coding-agent--remote-home-path-p path))
+              (if (string-match
+                   "\\`\\(~\\|~[[:alpha:]_][[:alnum:]_.-]*\\)\\(?:/\\|\\'\\)"
+                   path)
+                  (let* ((prefix (match-string 1 path))
+                         (prefix-end (match-end 1))
+                         (slash-p (and (< prefix-end (length path))
+                                       (eq (aref path prefix-end) ?/)))
+                         (rest (and slash-p
+                                    (substring path (1+ prefix-end)))))
+                    (if slash-p
+                        (concat prefix "/"
+                                (if (string-empty-p rest)
+                                    ""
+                                  (shell-quote-argument rest t)))
+                      prefix))
+                (user-error "Unsafe shell home prefix in path: %S" path))
+            (shell-quote-argument path (and remote-anchor t)))))
+    ;; `shell-command' detects a final ampersand lexically, without honoring
+    ;; shell escaping.  Concatenate an empty quoted fragment so a filename
+    ;; ending in `&' remains one operand but cannot switch execution to async.
+    (if (string-suffix-p "&" quoted)
+        (concat quoted
+                (shell-quote-argument "" (and remote-anchor t)))
+      quoted)))
+
 (defun pi-coding-agent--process-local-path (path &optional anchor)
   "Return outbound PATH as the process-local path Pi should receive.
 PATH must be a nonempty string; otherwise return nil.  Emacs/TRAMP paths are